nexus-agents 5.0.1 → 5.0.4

package/dist/{child-mcp-config-2EXF74GZ.js → child-mcp-config-PIZSE56V.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-4OW67KT2.js";
 import {
   createLogger
-} from "./chunk-AVYTX7JQ.js";
+} from "./chunk-6OPLDOJG.js";
 import "./chunk-GBHJ37V3.js";
 import "./chunk-OGHEKPLD.js";
 import "./chunk-ZPWHCABL.js";
@@ -62,4 +62,4 @@ export {
   generateMcpConfig,
   getDefaultAllowedTools
 };
-//# sourceMappingURL=child-mcp-config-2EXF74GZ.js.map
+//# sourceMappingURL=child-mcp-config-PIZSE56V.js.map

package/dist/{chunk-KYOVZ2QZ.js → chunk-2I5BBD6U.js}

@@ -5,13 +5,13 @@ import {
   loadTechniquesRegistry,
   resolveInsideRoot,
   savePapersRegistry
-} from "./chunk-Y4XI4RIB.js";
+} from "./chunk-F67CLL5B.js";
 import {
   resolveToken
-} from "./chunk-3IDYJL2Y.js";
+} from "./chunk-FWBR6DZO.js";
 import {
   getToolMemory
-} from "./chunk-VS2DUTJ5.js";
+} from "./chunk-P7IHQSCC.js";
 import {
   capitalizeWords,
   tokenizeFiltered,
@@ -37,7 +37,7 @@ import {
   getTimeProvider,
   ok,
   registerPersistentDistillerFactory
-} from "./chunk-AVYTX7JQ.js";
+} from "./chunk-6OPLDOJG.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -4132,4 +4132,4 @@ export {
   DEFAULT_CONTEXT_BUDGET_TOKENS,
   getContextPromptPrefix
 };
-//# sourceMappingURL=chunk-KYOVZ2QZ.js.map
+//# sourceMappingURL=chunk-2I5BBD6U.js.map

package/dist/{chunk-WTQEMR7D.js → chunk-5MQPSHIG.js}

@@ -1,11 +1,11 @@
 import {
   resolveCliSlot
-} from "./chunk-FWP5FZ7V.js";
+} from "./chunk-NDVKXAK5.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-AVYTX7JQ.js";
+} from "./chunk-6OPLDOJG.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -21,7 +21,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-2EXF74GZ.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-PIZSE56V.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -93,8 +93,8 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-S5K2EIKH.js");
-    const { createCompositeRouter } = await import("./composite-router-KL7ZLCJY.js");
+    const { createAllAdapters } = await import("./factory-3T6NTUDH.js");
+    const { createCompositeRouter } = await import("./composite-router-7D45ZSSG.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
       routerInitPromise = null;
@@ -102,7 +102,7 @@ async function getRouter() {
     }
     cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-UFQZZVAB.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-YEQKBXCN.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -213,4 +213,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-WTQEMR7D.js.map
+//# sourceMappingURL=chunk-5MQPSHIG.js.map

package/dist/{chunk-SOKS6XK2.js → chunk-5VP6WPEI.js}

@@ -2,7 +2,7 @@ import {
   computeTokenCost,
   getDefaultRegistry,
   roundToMicroUsd
-} from "./chunk-AVYTX7JQ.js";
+} from "./chunk-6OPLDOJG.js";
 import {
   getNexusDataDir
 } from "./chunk-OGHEKPLD.js";
@@ -131,4 +131,4 @@ export {
   loadUsageEvents,
   rollupByModel
 };
-//# sourceMappingURL=chunk-SOKS6XK2.js.map
+//# sourceMappingURL=chunk-5VP6WPEI.js.map

package/dist/{chunk-AVYTX7JQ.js → chunk-6OPLDOJG.js}

@@ -2632,7 +2632,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-YBGPLXH3.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-ZRG3SO3X.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -15245,7 +15245,7 @@ var CompositeRouter = class _CompositeRouter {
    */
   async consultUnifiedContext(task) {
     try {
-      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-GJL6HFJK.js");
+      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-3R3BWMEW.js");
       const ctx = await getContextForTask({
         task: task.content,
         category: inferTaskCategory(task.content),
@@ -16851,4 +16851,4 @@ export {
   AgentCapability,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-AVYTX7JQ.js.map
+//# sourceMappingURL=chunk-6OPLDOJG.js.map

package/dist/chunk-7VPZ26NW.js

@@ -0,0 +1,7 @@
+// src/version.ts
+var VERSION = true ? "5.0.4" : "dev";
+
+export {
+  VERSION
+};
+//# sourceMappingURL=chunk-7VPZ26NW.js.map

package/dist/{chunk-SZ6J4YY7.js → chunk-AS4B7KCT.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-AVYTX7JQ.js";
+} from "./chunk-6OPLDOJG.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-SZ6J4YY7.js.map
+//# sourceMappingURL=chunk-AS4B7KCT.js.map

package/dist/{chunk-BZRUZSJ6.js → chunk-BD6S7IQ3.js}

@@ -1,9 +1,9 @@
 import {
   VERSION
-} from "./chunk-7A63AX2A.js";
+} from "./chunk-7VPZ26NW.js";
 import {
   emitClawGuardViolation
-} from "./chunk-ZSNWRX2B.js";
+} from "./chunk-OOGKQTDN.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -19,7 +19,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-AVYTX7JQ.js";
+} from "./chunk-6OPLDOJG.js";
 import {
   getNexusDataDir
 } from "./chunk-OGHEKPLD.js";
@@ -649,24 +649,27 @@ function measuredTrustTier(context) {
 
 // src/mcp/middleware/tool-input-sanitizer.ts
 var XML_INJECTION_PATTERN = /<\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\b[^>]*>/gi;
+var HIDDEN_INSTRUCTION_TRIGGER = /execute|delete|merge|apply/i;
+function hasHiddenInstruction(value) {
+  const OPEN = "<!--";
+  const CLOSE = "-->";
+  let from = 0;
+  for (; ; ) {
+    const open = value.indexOf(OPEN, from);
+    if (open === -1) return false;
+    const close = value.indexOf(CLOSE, open + OPEN.length);
+    if (close === -1) return false;
+    if (HIDDEN_INSTRUCTION_TRIGGER.test(value.slice(open + OPEN.length, close))) {
+      return true;
+    }
+    from = close + CLOSE.length;
+  }
+}
 var INJECTION_DETECTORS = [
   { name: "system_prompt_override", pattern: /ignore (?:all )?previous (?:instructions|rules)/i },
   { name: "role_impersonation", pattern: /i(?:'m| am) the (?:repo |project )?(?:owner|admin)/i },
-  // The trigger must sit INSIDE one comment. `[\s\S]*?` used to cross an
-  // intervening `-->`, so any body with an opening comment, a trigger word
-  // anywhere in ordinary prose, and a later closing comment matched — a real
-  // PR body like "<!-- header -->\nsafe to merge after CI\n<!-- footer -->"
-  // was flagged (#5258). `(?:(?!-->)[\s\S])*?` is the standard tempered-dot
-  // form: consume any character that does not begin the terminator.
-  //
-  // KNOWN RESIDUAL: GitHub's default PR template contains
-  // "<!-- Please delete options that are not relevant -->", where the trigger
-  // genuinely is inside a single comment. Containment cannot help there; the
-  // trigger vocabulary overlaps ordinary English. Tracked in #5258.
-  {
-    name: "hidden_instruction",
-    pattern: /<!--(?:(?!-->)[\s\S])*?(?:execute|delete|merge|apply)(?:(?!-->)[\s\S])*?-->/i
-  }
+  // `hidden_instruction` is a scan, not a pattern — see hasHiddenInstruction.
+  { name: "hidden_instruction", match: hasHiddenInstruction }
 ];
 function sanitizeString(value) {
   const MAX_PASSES = 5;
@@ -681,9 +684,11 @@ function sanitizeString(value) {
 }
 function detectPatterns(value) {
   const detected = [];
-  for (const { name, pattern } of INJECTION_DETECTORS) {
-    pattern.lastIndex = 0;
-    if (pattern.test(value)) {
+  for (const { name, pattern, match } of INJECTION_DETECTORS) {
+    if (pattern !== void 0) {
+      pattern.lastIndex = 0;
+      if (pattern.test(value)) detected.push(name);
+    } else if (match?.(value) === true) {
       detected.push(name);
     }
   }
@@ -2130,4 +2135,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-BZRUZSJ6.js.map
+//# sourceMappingURL=chunk-BD6S7IQ3.js.map