nexus-agents 7.0.0 → 7.0.2

package/dist/{chunk-MB2YIETU.js → chunk-IWTK6FDT.js}

@@ -4,7 +4,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 
 // src/scm/types.ts
 var ScmError = class extends Error {
@@ -263,4 +263,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-MB2YIETU.js.map
+//# sourceMappingURL=chunk-IWTK6FDT.js.map

package/dist/{chunk-5EEEPQZY.js → chunk-JJT7NVNY.js}

@@ -12,11 +12,11 @@ import {
   gateWithReputation,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-NVFYMGCC.js";
+} from "./chunk-RLBJTZHA.js";
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 
 // src/dogfooding/pr-reviewer-helpers.ts
 import { randomUUID } from "crypto";
@@ -303,4 +303,4 @@ export {
   createFailedReview,
   reviewPostingBlock
 };
-//# sourceMappingURL=chunk-5EEEPQZY.js.map
+//# sourceMappingURL=chunk-JJT7NVNY.js.map

package/dist/{chunk-6ZYJ46HN.js → chunk-JNZ3D5B5.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 
 // src/context/session-memory.ts
 import * as fs from "fs";
@@ -366,4 +366,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-6ZYJ46HN.js.map
+//# sourceMappingURL=chunk-JNZ3D5B5.js.map

package/dist/{chunk-VNULIWRK.js → chunk-K2AWJGQO.js}

@@ -5,7 +5,7 @@ import {
   getErrorMessage,
   ok,
   parseBoolEnv
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 
 // src/cli/research-helpers-io.ts
 import * as fs2 from "fs/promises";
@@ -156,4 +156,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-VNULIWRK.js.map
+//# sourceMappingURL=chunk-K2AWJGQO.js.map

package/dist/{chunk-ET67NYCJ.js → chunk-KJWD2V4K.js}

@@ -1,11 +1,11 @@
 import {
   resolveCliSlot
-} from "./chunk-PCZJMNPT.js";
+} from "./chunk-6GYTTWNM.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -21,7 +21,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-IPWKOUSE.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-ORXLS5HP.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -93,8 +93,8 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-Q7D2MNS2.js");
-    const { createCompositeRouter } = await import("./composite-router-GEQSU4S3.js");
+    const { createAllAdapters } = await import("./factory-3BZDQQYM.js");
+    const { createCompositeRouter } = await import("./composite-router-GE24MYPP.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
       routerInitPromise = null;
@@ -102,7 +102,7 @@ async function getRouter() {
     }
     cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-TEW4RTM2.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-5FYJDS5O.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -213,4 +213,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-ET67NYCJ.js.map
+//# sourceMappingURL=chunk-KJWD2V4K.js.map

package/dist/{chunk-WMXHD6UA.js → chunk-KUYKSKPV.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-L3ZVRVHA.js";
+} from "./chunk-VYAXMVI5.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-HFOQKCD2.js";
@@ -21,10 +21,10 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-46XUGUB4.js";
+} from "./chunk-WLIXCNZ6.js";
 import {
   executeExpert
-} from "./chunk-ET67NYCJ.js";
+} from "./chunk-KJWD2V4K.js";
 import {
   JobStatusSchema,
   VOTER_ROLES,
@@ -47,24 +47,24 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-K3ZTZSLW.js";
+} from "./chunk-OHULIRP6.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-LUPEM2NF.js";
+} from "./chunk-UVO673OY.js";
 import {
   IssueTriage
-} from "./chunk-T47DKINM.js";
+} from "./chunk-Q6IODDEA.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-NVFYMGCC.js";
+} from "./chunk-RLBJTZHA.js";
 import {
   withPrerequisite
-} from "./chunk-6SA3FIBZ.js";
+} from "./chunk-AGFXJUTS.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -78,6 +78,7 @@ import {
   getToolAnnotations,
   getToolTimeout,
   measuredTrustTier,
+  sanitizeToolInput,
   toSdkCallback,
   toSdkCallbackWithBudgetCheck,
   toolError,
@@ -88,18 +89,18 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-XF6J4PCH.js";
+} from "./chunk-GAYSJGKD.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-DR7DYEFQ.js";
+} from "./chunk-6Q3KSZVI.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-KXQNETUB.js";
+} from "./chunk-D6TL5GZV.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -132,29 +133,29 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-RSSLLOU6.js";
+} from "./chunk-QAHGHWC7.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveInsideRoot
-} from "./chunk-VNULIWRK.js";
+} from "./chunk-K2AWJGQO.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-SZZRE2VU.js";
+} from "./chunk-XZEYSIGG.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-DXIZQRP5.js";
+} from "./chunk-7U7HAYPB.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-6T3EPABN.js";
 import {
   createSessionMemory
-} from "./chunk-6ZYJ46HN.js";
+} from "./chunk-JNZ3D5B5.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -172,25 +173,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-KYCJ47JZ.js";
+} from "./chunk-BTWKDT4F.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-UAKFLKW3.js";
+} from "./chunk-LVYRGNOC.js";
 import {
   DEFAULTS
-} from "./chunk-KLQ352NK.js";
+} from "./chunk-ZD4VEHEG.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-PCZJMNPT.js";
+} from "./chunk-6GYTTWNM.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-XOCNOKIV.js";
+} from "./chunk-33FI7W3G.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -296,7 +297,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-UOHOHH72.js";
+} from "./chunk-Y742U2YM.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -29692,7 +29693,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-ECGC4EFR.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-3OO6N4V6.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -45572,7 +45573,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-A7JXRGSV.js");
+    const { createIssueTriage } = await import("./issue-triage-2LNYGQRJ.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -45600,7 +45601,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-DWBQLHPG.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-PWRVRFDG.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -47291,7 +47292,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-M2LUBDCR.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-YQQVPLKM.js");
     const { getLearningDir } = await import("./learning-persistence-7O5QYDM7.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -47353,7 +47354,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-5CLHRWID.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-2SMMUPTB.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -47387,7 +47388,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-XMWNDDHY.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-6AVPMHHM.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -47405,7 +47406,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-M2LUBDCR.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-YQQVPLKM.js");
     const { getLearningDir } = await import("./learning-persistence-7O5QYDM7.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -47524,7 +47525,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-ZMEESJFP.js");
+        const { executeVoting } = await import("./consensus-vote-62FAN4ZN.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -47953,7 +47954,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-3YBPFYMX.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-QY3DDHTD.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -48024,7 +48025,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-TW3D5JPQ.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-SZU4O2TN.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -48829,32 +48830,45 @@ function absoluteQuorumApprove(reviews, valid) {
   return { decision: "approve", verified: true };
 }
 function buildPrReviewProposal(input) {
+  const sanitizeResult = sanitizeToolInput({
+    prTitle: input.prTitle,
+    prDescription: input.prDescription,
+    prDiff: input.prDiff,
+    repoContext: input.repoContext
+  });
+  const safe = sanitizeResult.sanitized;
   const parts = [];
   parts.push(`# Pull Request Review
 `);
-  parts.push(`**Title:** ${input.prTitle}
+  if (sanitizeResult.commentsRemoved > 0) {
+    parts.push(
+      `> **Note:** ${String(sanitizeResult.commentsRemoved)} HTML comment(s) were removed from the untrusted fields below before you saw them (#5258). Comments are invisible in rendered markdown, so they are stripped rather than trusted. This is routine \u2014 GitHub's default PR template contains one \u2014 and is not by itself evidence of an attack.
+`
+    );
+  }
+  parts.push(`**Title:** ${safe.prTitle}
 `);
   if (input.baseRef !== void 0 && input.headRef !== void 0) {
     parts.push(`**Branches:** ${input.headRef} \u2192 ${input.baseRef}
 `);
   }
-  if (input.repoContext !== void 0 && input.repoContext !== "") {
+  if (safe.repoContext !== void 0 && safe.repoContext !== "") {
     parts.push(`
 **Repo context:**
-${input.repoContext}
+${safe.repoContext}
 `);
   }
-  if (input.prDescription !== void 0 && input.prDescription !== "") {
+  if (safe.prDescription !== void 0 && safe.prDescription !== "") {
     parts.push(`
 **Description:**
-${input.prDescription}
+${safe.prDescription}
 `);
   }
   parts.push(`
 ## Diff
 
 \`\`\`diff
-${input.prDiff}
+${safe.prDiff}
 \`\`\`
 `);
   parts.push(`
@@ -51168,7 +51182,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-OTIHI4GK.js");
+    const { createScmProvider } = await import("./factory-UFKRSADE.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -52083,7 +52097,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-Q7D2MNS2.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-3BZDQQYM.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -56155,4 +56169,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-WMXHD6UA.js.map
+//# sourceMappingURL=chunk-KUYKSKPV.js.map