nexus-agents 2.54.1 → 2.55.0

package/dist/{chunk-LSHIG4SR.js → chunk-HQ43NDJW.js}

@@ -2792,8 +2792,108 @@ function createClaudeAdapter(config) {
 var PROVIDER_ENV_KEYS = {
   anthropic: "ANTHROPIC_API_KEY",
   openai: "OPENAI_API_KEY",
-  google: "GOOGLE_AI_API_KEY"
+  google: "GOOGLE_AI_API_KEY",
+  "custom-openai": "NEXUS_CUSTOM_API_KEY"
 };
+var CUSTOM_API_BASE_URL_ENV = "NEXUS_CUSTOM_API_BASE_URL";
+var CUSTOM_API_ALLOW_PRIVATE_ENV = "NEXUS_CUSTOM_API_ALLOW_PRIVATE";
+
+// src/adapters/sdk/custom-api-validation.ts
+import { isIPv4, isIPv6 } from "net";
+function validateCustomApiBaseUrl(raw, opts = {}) {
+  if (raw === void 0 || raw.trim() === "") {
+    return err(
+      new ConfigError(
+        "Custom API base URL is required but missing. Set NEXUS_CUSTOM_API_BASE_URL or pass `baseUrl` in config."
+      )
+    );
+  }
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return err(new ConfigError(`Custom API base URL is not a valid URL: ${raw}`));
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return err(
+      new ConfigError(`Custom API base URL must use http or https, got "${url.protocol}" in ${raw}`)
+    );
+  }
+  const allowPrivate = opts.allowPrivate === true || resolveAllowPrivateFromEnv();
+  if (!allowPrivate) {
+    const rejection = classifyPrivateHost(url.hostname);
+    if (rejection !== null) {
+      return err(
+        new ConfigError(
+          `Custom API base URL rejected (SSRF guard, reason="${rejection.reason}"): ${rejection.message}. Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 to bypass if the gateway runs on a trusted internal host.`
+        )
+      );
+    }
+  }
+  return ok(url);
+}
+function resolveAllowPrivateFromEnv() {
+  const v = process.env[CUSTOM_API_ALLOW_PRIVATE_ENV];
+  return v === "1" || v === "true";
+}
+function classifyPrivateHost(hostname) {
+  const stripped = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  const normalized = stripped.toLowerCase();
+  if (isIPv4(normalized)) {
+    return classifyIPv4(normalized);
+  }
+  if (isIPv6(normalized)) {
+    return classifyIPv6(normalized);
+  }
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local")) {
+    return {
+      reason: "loopback",
+      message: `hostname "${hostname}" resolves to loopback/mDNS`
+    };
+  }
+  return null;
+}
+var IPV4_RULES = [
+  { match: (a) => a === 127, reason: "loopback", label: "IPv4 loopback" },
+  { match: (a) => a === 10, reason: "private_range", label: "IPv4 private (10/8)" },
+  {
+    match: (a, b) => a === 172 && b >= 16 && b <= 31,
+    reason: "private_range",
+    label: "IPv4 private (172.16/12)"
+  },
+  {
+    match: (a, b) => a === 192 && b === 168,
+    reason: "private_range",
+    label: "IPv4 private (192.168/16)"
+  },
+  {
+    match: (a, b) => a === 169 && b === 254,
+    reason: "link_local",
+    label: "IPv4 link-local (169.254/16 \u2014 AWS IMDS)"
+  },
+  { match: (a) => a === 0, reason: "reserved", label: "IPv4 reserved (0/8)" }
+];
+function classifyIPv4(ip) {
+  const parts = ip.split(".").map((p) => Number.parseInt(p, 10));
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return null;
+  const [a, b] = parts;
+  for (const rule of IPV4_RULES) {
+    if (rule.match(a, b)) {
+      return { reason: rule.reason, message: `${rule.label} (${ip})` };
+    }
+  }
+  return null;
+}
+function classifyIPv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === "::1") return { reason: "loopback", message: `IPv6 loopback (${ip})` };
+  if (lower.startsWith("fe80:"))
+    return { reason: "link_local", message: `IPv6 link-local (${ip})` };
+  if (/^fc|^fd/.test(lower)) {
+    return { reason: "private_range", message: `IPv6 unique-local (${ip}, fc00::/7)` };
+  }
+  return null;
+}
 
 // src/adapters/sdk/sdk-adapter.ts
 function extractProviderFactory(mod, factoryName) {
@@ -2822,6 +2922,13 @@ function resolveApiKey(providerId, configKey) {
   const envVar = PROVIDER_ENV_KEYS[providerId];
   return process.env[envVar];
 }
+function resolveAndValidateCustomBaseUrl(config) {
+  if (config.providerId !== "custom-openai") return void 0;
+  const raw = config.baseUrl ?? process.env[CUSTOM_API_BASE_URL_ENV];
+  const validated = validateCustomApiBaseUrl(raw);
+  if (!validated.ok) throw validated.error;
+  return validated.value.toString();
+}
 function mapFinishReason(reason) {
   switch (reason) {
     case "stop":
@@ -2853,6 +2960,8 @@ var SdkAdapter = class extends BaseAdapter {
   model;
   sdkFunctions;
   sdkConfig;
+  /** Validated base URL for custom-openai provider; undefined for built-ins. */
+  customBaseUrl;
   /** Inflight init promise for coalescing concurrent calls (Issue #1438). */
   initPromise;
   constructor(config, logger11) {
@@ -2868,6 +2977,7 @@ var SdkAdapter = class extends BaseAdapter {
     });
     this.sdkProviderId = config.providerId;
     this.sdkConfig = config;
+    this.customBaseUrl = resolveAndValidateCustomBaseUrl(config);
   }
   /**
    * Lazily initialize the AI SDK model and functions.
@@ -2926,6 +3036,14 @@ var SdkAdapter = class extends BaseAdapter {
         const provider = factory({ apiKey });
         return { model: provider(this.modelId) };
       }
+      case "custom-openai": {
+        const mod = await import("@ai-sdk/openai");
+        const factory = extractProviderFactory(mod, "createOpenAI");
+        const opts = { apiKey };
+        if (this.customBaseUrl !== void 0) opts["baseURL"] = this.customBaseUrl;
+        const provider = factory(opts);
+        return { model: provider(this.modelId) };
+      }
     }
   }
   /**
@@ -3115,9 +3233,34 @@ function tryApiAdapter(config, logger11) {
       reason: `Using Google AI API via AI SDK (model: ${geminiModelId})`
     };
   }
+  const custom = tryCustomOpenAiAdapter(logger11);
+  if (custom !== null) return custom;
   logger11.info("No API keys available for any provider");
   return null;
 }
+function tryCustomOpenAiAdapter(logger11) {
+  const customKey = resolveApiKeyFromEnv(void 0, "NEXUS_CUSTOM_API_KEY");
+  const customBaseUrl = process.env["NEXUS_CUSTOM_API_BASE_URL"];
+  if (customKey === void 0 || customBaseUrl === void 0 || customBaseUrl === "") {
+    return null;
+  }
+  const customModelId = process.env["NEXUS_CUSTOM_MODEL"] ?? "gpt-4o";
+  logger11.info("Using custom-openai SDK adapter", {
+    model: customModelId,
+    baseUrl: customBaseUrl
+  });
+  return {
+    adapter: new SdkAdapter({
+      providerId: "custom-openai",
+      modelId: customModelId,
+      apiKey: customKey,
+      baseUrl: customBaseUrl
+    }),
+    source: "api",
+    name: "custom-openai",
+    reason: `Using custom OpenAI-compatible gateway at ${customBaseUrl} (model: ${customModelId})`
+  };
+}
 async function selectCliFirst(config, logger11, cache) {
   const cliResult = await tryCliAdapter(config, logger11, cache);
   if (cliResult !== null) return cliResult;
@@ -12936,4 +13079,4 @@ export {
   CONSENSUS_VOTE_OUTPUT_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-LSHIG4SR.js.map
+//# sourceMappingURL=chunk-HQ43NDJW.js.map