nexus-agents 2.109.1 → 2.109.4

package/dist/{chunk-RCN76RFJ.js → chunk-OLCFAA7D.js}

@@ -19,7 +19,7 @@ import {
   delay,
   getAvailableClis,
   withTimeout
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-DMUUE2S5.js";
 import {
   mapModelErrorToCategory
 } from "./chunk-K3UILZ5X.js";
@@ -6127,7 +6127,7 @@ async function processVotesWithCascade(engineVotes, opts) {
 var CONTRARIAN_ESCALATION_THRESHOLD = 0.8;
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-N7PLXYBV.js");
+    const { executeExpert } = await import("./expert-bridge-GIUSXOTJ.js");
     const prompt = [
       "You are a contrarian analyst. Your job is to find reasons this proposal should be REJECTED.",
       "Look for: YAGNI (not needed), MISALIGNED (wrong tech/architecture), SECURITY_RISK, SCOPE_CREEP.",
@@ -6611,4 +6611,4 @@ export {
   CONSENSUS_VOTE_OUTPUT_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-RCN76RFJ.js.map
+//# sourceMappingURL=chunk-OLCFAA7D.js.map

package/dist/{chunk-IUDSDQIF.js → chunk-SL23XVXX.js}

@@ -8,10 +8,10 @@ import {
   checkSqlite,
   defaultConfig,
   initDataDirectories
-} from "./chunk-SAR5IO7V.js";
+} from "./chunk-YKJVX56L.js";
 import {
   probeAllClis
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-DMUUE2S5.js";
 import {
   BUILT_IN_EXPERTS
 } from "./chunk-ZM4O442V.js";
@@ -1987,4 +1987,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=chunk-IUDSDQIF.js.map
+//# sourceMappingURL=chunk-SL23XVXX.js.map

package/dist/{chunk-O737ZOZ6.js → chunk-XTJ4FU2W.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-TJUGEDQI.js";
 import {
   executeExpert
-} from "./chunk-HBPDYYIT.js";
+} from "./chunk-5R5SYTLS.js";
 import {
   EventTopics,
   JobStatusSchema,
@@ -30,7 +30,7 @@ import {
   writeJobComplete,
   writeJobFailed,
   writeJobPending
-} from "./chunk-RCN76RFJ.js";
+} from "./chunk-OLCFAA7D.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
@@ -93,7 +93,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-SAR5IO7V.js";
+} from "./chunk-YKJVX56L.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
@@ -109,10 +109,10 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-DMUUE2S5.js";
 import {
   DEFAULTS
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
@@ -42859,7 +42859,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-N7PLXYBV.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-GIUSXOTJ.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -43999,7 +43999,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-HK5G3DYU.js");
+        const { executeVoting } = await import("./consensus-vote-U6JAB527.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -46594,7 +46594,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-UVXXFLOI.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-U2RYH6FT.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -50920,4 +50920,4 @@ export {
   detectBackend,
   createTaskTracker
 };
-//# sourceMappingURL=chunk-O737ZOZ6.js.map
+//# sourceMappingURL=chunk-XTJ4FU2W.js.map

package/dist/{chunk-SAR5IO7V.js → chunk-YKJVX56L.js}

@@ -7,10 +7,10 @@ import {
 import {
   createAllAdapters,
   probeCli
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-DMUUE2S5.js";
 import {
   DEFAULTS
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import {
   CliNameSchema,
   DEFAULT_CAPABILITIES,
@@ -40,7 +40,7 @@ import {
 } from "./chunk-CH7QIDHQ.js";
 
 // src/version.ts
-var VERSION = true ? "2.109.1" : "dev";
+var VERSION = true ? "2.109.4" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2096,7 +2096,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-O4BGMJIC.js");
+    const { runSetup } = await import("./setup-command-Y5IYAREF.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2208,4 +2208,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-SAR5IO7V.js.map
+//# sourceMappingURL=chunk-YKJVX56L.js.map

package/dist/cli.js

@@ -24,7 +24,7 @@ import {
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-IUDSDQIF.js";
+} from "./chunk-SL23XVXX.js";
 import "./chunk-V5UOHHOD.js";
 import {
   AuthHandler,
@@ -166,7 +166,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-O737ZOZ6.js";
+} from "./chunk-XTJ4FU2W.js";
 import "./chunk-3ACDP4E6.js";
 import {
   resolveToken
@@ -179,7 +179,7 @@ import "./chunk-LLM3HY54.js";
 import "./chunk-H47QJVMR.js";
 import {
   shutdownExpertBridge
-} from "./chunk-HBPDYYIT.js";
+} from "./chunk-5R5SYTLS.js";
 import {
   DEFAULT_VOTE_TIMEOUT_MS,
   ErrorPolicySchema,
@@ -189,7 +189,7 @@ import {
   executeVoting,
   registerConsensusVoteTool,
   warnIfSimulatedOutsideTests
-} from "./chunk-RCN76RFJ.js";
+} from "./chunk-OLCFAA7D.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
@@ -249,7 +249,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-SAR5IO7V.js";
+} from "./chunk-YKJVX56L.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   capitalize,
@@ -261,11 +261,11 @@ import {
   getAvailableClis,
   isRecord,
   probeAllClis
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-DMUUE2S5.js";
 import "./chunk-H6Q3EPQG.js";
 import {
   DEFAULTS
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -20594,7 +20594,7 @@ async function handleSetupCommandAsync(args) {
   process.exit(exitCode === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-SMLJ27IY.js");
+  const { configureCustomApi } = await import("./setup-custom-api-UTROX3FM.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {

package/dist/{consensus-vote-HK5G3DYU.js → consensus-vote-U6JAB527.js}

@@ -6,13 +6,13 @@ import {
   executeVoting,
   registerConsensusVoteTool,
   resetCorrelationTracker
-} from "./chunk-RCN76RFJ.js";
+} from "./chunk-OLCFAA7D.js";
 import "./chunk-4QH4IHCY.js";
 import "./chunk-5H3YYSMY.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-N5I4PC3P.js";
+import "./chunk-DMUUE2S5.js";
 import "./chunk-H6Q3EPQG.js";
-import "./chunk-ZFDG2CDY.js";
+import "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -30,4 +30,4 @@ export {
   registerConsensusVoteTool,
   resetCorrelationTracker
 };
-//# sourceMappingURL=consensus-vote-HK5G3DYU.js.map
+//# sourceMappingURL=consensus-vote-U6JAB527.js.map

package/dist/{expert-bridge-N7PLXYBV.js → expert-bridge-GIUSXOTJ.js}

@@ -3,7 +3,7 @@ import {
   shutdownExpertBridge,
   tokenSplitFromUsage,
   totalTokensFromUsage
-} from "./chunk-HBPDYYIT.js";
+} from "./chunk-5R5SYTLS.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-VO7FEIXD.js";
 import "./chunk-CH7QIDHQ.js";
@@ -14,4 +14,4 @@ export {
   tokenSplitFromUsage,
   totalTokensFromUsage
 };
-//# sourceMappingURL=expert-bridge-N7PLXYBV.js.map
+//# sourceMappingURL=expert-bridge-GIUSXOTJ.js.map

package/dist/{factory-UVXXFLOI.js → factory-U2RYH6FT.js}

@@ -3,9 +3,9 @@ import {
   createCliAdapter,
   getAvailableClis,
   isCliAvailable
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-DMUUE2S5.js";
 import "./chunk-H6Q3EPQG.js";
-import "./chunk-ZFDG2CDY.js";
+import "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -18,4 +18,4 @@ export {
   getAvailableClis,
   isCliAvailable
 };
-//# sourceMappingURL=factory-UVXXFLOI.js.map
+//# sourceMappingURL=factory-U2RYH6FT.js.map

package/dist/index.d.ts

@@ -7288,6 +7288,12 @@ declare class SdkAdapter extends BaseAdapter {
     private readonly customBaseUrl;
     /** Inflight init promise for coalescing concurrent calls (Issue #1438). */
     private initPromise;
+    /**
+     * Cached result of the DNS-resolve-time SSRF check for custom-openai
+     * (#3426). Resolved once on first init so we don't re-resolve the gateway
+     * hostname on every request. `undefined` until the check has run.
+     */
+    private resolveSsrfChecked;
     constructor(config: SdkAdapterConfig, logger?: ILogger);
     /**
      * Lazily initialize the AI SDK model and functions.
@@ -7296,6 +7302,14 @@ declare class SdkAdapter extends BaseAdapter {
      */
     private ensureInitialized;
     private doInitialize;
+    /**
+     * For custom-openai only: run the DNS-resolve-time SSRF check exactly once
+     * and throw if the gateway hostname resolves to a private address (#3426).
+     * Cached via `resolveSsrfChecked` so the hostname is not re-resolved on
+     * every request. No-op for non-custom providers (built-in endpoints are
+     * trusted) and when no custom base URL is configured.
+     */
+    private ensureCustomHostResolvesPublic;
     /**
      * Loads the provider-specific AI SDK module.
      *

package/dist/index.js

@@ -517,7 +517,7 @@ import {
   validateWorkflow,
   validateWorkflowDependencies,
   withLogging
-} from "./chunk-O737ZOZ6.js";
+} from "./chunk-XTJ4FU2W.js";
 import "./chunk-3ACDP4E6.js";
 import {
   getTokenEnvVars,
@@ -537,7 +537,7 @@ import {
 } from "./chunk-H47QJVMR.js";
 import {
   executeExpert
-} from "./chunk-HBPDYYIT.js";
+} from "./chunk-5R5SYTLS.js";
 import {
   AgentFindingSchema,
   AgentPerformanceSchema,
@@ -604,7 +604,7 @@ import {
   resetGlobalRegistry,
   withModelNotFoundFallback,
   wrapResilientWithFallback
-} from "./chunk-RCN76RFJ.js";
+} from "./chunk-OLCFAA7D.js";
 import "./chunk-UIFDDBIG.js";
 import {
   AgentActionSchema,
@@ -723,7 +723,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-SAR5IO7V.js";
+} from "./chunk-YKJVX56L.js";
 import "./chunk-NUBSJGQZ.js";
 import "./chunk-6T3EPABN.js";
 import {
@@ -763,7 +763,7 @@ import {
   isRetryableError,
   messagesToAnthropicFormat,
   sleep
-} from "./chunk-N5I4PC3P.js";
+} from "./chunk-DMUUE2S5.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -791,7 +791,7 @@ import {
 import {
   DEFAULTS,
   PROVIDER_ENV_KEYS
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import {
   AvailabilityCache,
@@ -6082,7 +6082,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-HK5G3DYU.js");
+    const { executeVoting } = await import("./consensus-vote-U6JAB527.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);

package/dist/{setup-command-O4BGMJIC.js → setup-command-Y5IYAREF.js}

@@ -8,14 +8,14 @@ import {
   runWizard,
   setupCommand,
   setupCommandAsync
-} from "./chunk-IUDSDQIF.js";
+} from "./chunk-SL23XVXX.js";
 import "./chunk-V5UOHHOD.js";
-import "./chunk-SAR5IO7V.js";
+import "./chunk-YKJVX56L.js";
 import "./chunk-NUBSJGQZ.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-N5I4PC3P.js";
+import "./chunk-DMUUE2S5.js";
 import "./chunk-H6Q3EPQG.js";
-import "./chunk-ZFDG2CDY.js";
+import "./chunk-4C6M5YOH.js";
 import "./chunk-K3UILZ5X.js";
 import "./chunk-RMTFEDQV.js";
 import "./chunk-IJZGHD7O.js";
@@ -34,4 +34,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=setup-command-O4BGMJIC.js.map
+//# sourceMappingURL=setup-command-Y5IYAREF.js.map

package/dist/{setup-custom-api-SMLJ27IY.js → setup-custom-api-UTROX3FM.js}

@@ -3,7 +3,7 @@ import {
   CUSTOM_API_BASE_URL_ENV,
   CUSTOM_API_DEFAULT_MODEL,
   validateCustomApiBaseUrl
-} from "./chunk-ZFDG2CDY.js";
+} from "./chunk-4C6M5YOH.js";
 import {
   err,
   ok
@@ -104,4 +104,4 @@ function buildShellFragment(params) {
 export {
   configureCustomApi
 };
-//# sourceMappingURL=setup-custom-api-SMLJ27IY.js.map
+//# sourceMappingURL=setup-custom-api-UTROX3FM.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-agents",
-  "version": "2.109.1",
+  "version": "2.109.4",
   "description": "Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, immutable audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode",
   "mcpName": "io.github.nexus-substrate/nexus-agents",
   "license": "MIT",