nexus-agents 5.0.1 → 5.0.3

package/dist/{chunk-GQXDNAMB.js → chunk-AU6N4HZR.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-BZRUZSJ6.js";
+} from "./chunk-O6TCROTE.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2159,4 +2159,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-GQXDNAMB.js.map
+//# sourceMappingURL=chunk-AU6N4HZR.js.map

package/dist/{chunk-DDUZI6OD.js → chunk-FTIJ4V4A.js}

@@ -23,7 +23,7 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-BZRUZSJ6.js";
+} from "./chunk-O6TCROTE.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -6848,4 +6848,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-DDUZI6OD.js.map
+//# sourceMappingURL=chunk-FTIJ4V4A.js.map

package/dist/{chunk-BZRUZSJ6.js → chunk-O6TCROTE.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-7A63AX2A.js";
+} from "./chunk-RXJHAUJY.js";
 import {
   emitClawGuardViolation
 } from "./chunk-ZSNWRX2B.js";
@@ -649,24 +649,27 @@ function measuredTrustTier(context) {
 
 // src/mcp/middleware/tool-input-sanitizer.ts
 var XML_INJECTION_PATTERN = /<\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\b[^>]*>/gi;
+var HIDDEN_INSTRUCTION_TRIGGER = /execute|delete|merge|apply/i;
+function hasHiddenInstruction(value) {
+  const OPEN = "<!--";
+  const CLOSE = "-->";
+  let from = 0;
+  for (; ; ) {
+    const open = value.indexOf(OPEN, from);
+    if (open === -1) return false;
+    const close = value.indexOf(CLOSE, open + OPEN.length);
+    if (close === -1) return false;
+    if (HIDDEN_INSTRUCTION_TRIGGER.test(value.slice(open + OPEN.length, close))) {
+      return true;
+    }
+    from = close + CLOSE.length;
+  }
+}
 var INJECTION_DETECTORS = [
   { name: "system_prompt_override", pattern: /ignore (?:all )?previous (?:instructions|rules)/i },
   { name: "role_impersonation", pattern: /i(?:'m| am) the (?:repo |project )?(?:owner|admin)/i },
-  // The trigger must sit INSIDE one comment. `[\s\S]*?` used to cross an
-  // intervening `-->`, so any body with an opening comment, a trigger word
-  // anywhere in ordinary prose, and a later closing comment matched — a real
-  // PR body like "<!-- header -->\nsafe to merge after CI\n<!-- footer -->"
-  // was flagged (#5258). `(?:(?!-->)[\s\S])*?` is the standard tempered-dot
-  // form: consume any character that does not begin the terminator.
-  //
-  // KNOWN RESIDUAL: GitHub's default PR template contains
-  // "<!-- Please delete options that are not relevant -->", where the trigger
-  // genuinely is inside a single comment. Containment cannot help there; the
-  // trigger vocabulary overlaps ordinary English. Tracked in #5258.
-  {
-    name: "hidden_instruction",
-    pattern: /<!--(?:(?!-->)[\s\S])*?(?:execute|delete|merge|apply)(?:(?!-->)[\s\S])*?-->/i
-  }
+  // `hidden_instruction` is a scan, not a pattern — see hasHiddenInstruction.
+  { name: "hidden_instruction", match: hasHiddenInstruction }
 ];
 function sanitizeString(value) {
   const MAX_PASSES = 5;
@@ -681,9 +684,11 @@ function sanitizeString(value) {
 }
 function detectPatterns(value) {
   const detected = [];
-  for (const { name, pattern } of INJECTION_DETECTORS) {
-    pattern.lastIndex = 0;
-    if (pattern.test(value)) {
+  for (const { name, pattern, match } of INJECTION_DETECTORS) {
+    if (pattern !== void 0) {
+      pattern.lastIndex = 0;
+      if (pattern.test(value)) detected.push(name);
+    } else if (match?.(value) === true) {
       detected.push(name);
     }
   }
@@ -2130,4 +2135,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-BZRUZSJ6.js.map
+//# sourceMappingURL=chunk-O6TCROTE.js.map