nexus-agents 8.107.0 → 8.108.1

package/dist/{ast-rule-runner-PXPUTAD7.js → ast-rule-runner-KZMBJQLP.js}

@@ -9,9 +9,9 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-XQ7CKD4D.js";
+} from "./chunk-N6KPLEMJ.js";
 import "./chunk-XEPZSDN5.js";
-import "./chunk-4AVYG4NB.js";
+import "./chunk-RTH5A2UF.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -27,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-PXPUTAD7.js.map
+//# sourceMappingURL=ast-rule-runner-KZMBJQLP.js.map

package/dist/{child-mcp-config-NMZBXRRH.js → child-mcp-config-IB73HXHT.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -56,4 +56,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-NMZBXRRH.js.map
+//# sourceMappingURL=child-mcp-config-IB73HXHT.js.map

package/dist/{chunk-PO4YA4WF.js → chunk-26G6WKXC.js}

@@ -13,7 +13,7 @@ import {
   lookupInTreeCapability,
   ok,
   resolveRetryAfterMs
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/adapters/base-adapter.ts
 var AdapterModelError = class extends ModelError {
@@ -1046,4 +1046,4 @@ export {
   gatewayClientOptions,
   gatewayAiSdkOptions
 };
-//# sourceMappingURL=chunk-PO4YA4WF.js.map
+//# sourceMappingURL=chunk-26G6WKXC.js.map

package/dist/{chunk-LUHRNBAH.js → chunk-2FHRJR4I.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "node:crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-LUHRNBAH.js.map
+//# sourceMappingURL=chunk-2FHRJR4I.js.map

package/dist/{chunk-5NVMQ2XV.js → chunk-34KB3PTX.js}

@@ -1,15 +1,15 @@
 import {
   ensureGatewayDiscovered,
   gatewayDiscoveryGeneration
-} from "./chunk-SYFH3NYH.js";
+} from "./chunk-ENJAJCBQ.js";
 import {
   resolveCliSlot
-} from "./chunk-MENV3RNE.js";
+} from "./chunk-YKMMCFAK.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -34,7 +34,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-NMZBXRRH.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-IB73HXHT.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -122,8 +122,8 @@ async function getRouter() {
   }
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-Y57G22HJ.js");
-    const { createCompositeRouter } = await import("./composite-router-4L4LEVTV.js");
+    const { createAllAdapters } = await import("./factory-LRJQQDEM.js");
+    const { createCompositeRouter } = await import("./composite-router-FVXOTCQA.js");
     const adapters = createAllAdapters();
     const superseded = generation !== routerGeneration;
     if (adapters.size === 0) {
@@ -134,7 +134,7 @@ async function getRouter() {
     if (superseded) return router;
     cachedRouter = router;
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-QDJLE73G.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-CLL3LOLL.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -267,4 +267,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-5NVMQ2XV.js.map
+//# sourceMappingURL=chunk-34KB3PTX.js.map

package/dist/{chunk-2NDA4DHW.js → chunk-37GZJOQE.js}

@@ -17,6 +17,12 @@ var KEY_PATTERNS = [
   /ghp_[A-Za-z0-9]{20,}/g,
   // GitHub OAuth: gho_...
   /gho_[A-Za-z0-9]{20,}/g,
+  // GitHub user-to-server: ghu_...
+  /ghu_[A-Za-z0-9]{20,}/g,
+  // GitHub server-to-server (app installation): ghs_...
+  /ghs_[A-Za-z0-9]{20,}/g,
+  // GitHub fine-grained PAT: github_pat_...
+  /github_pat_[A-Za-z0-9_]{22,}/g,
   // GitLab PAT: glpat-...
   /glpat-[A-Za-z0-9_-]{10,}/g,
   // npm token: npm_...
@@ -24,6 +30,7 @@ var KEY_PATTERNS = [
   // PyPI token: pypi-...
   /pypi-[A-Za-z0-9_-]{20,}/g
 ];
+var URL_USERINFO_PATTERN = /\b([a-z][a-z0-9+.-]{0,31}:\/\/)[^\s/?#@:]{0,256}(?::[^\s/?#@]{0,256})?@/gi;
 function sanitizeOutput(text, placeholder = REDACTED_KEY_PLACEHOLDER) {
   if (text === "") return text;
   let result = text;
@@ -31,7 +38,8 @@ function sanitizeOutput(text, placeholder = REDACTED_KEY_PLACEHOLDER) {
     pattern.lastIndex = 0;
     result = result.replace(pattern, placeholder);
   }
-  return result;
+  URL_USERINFO_PATTERN.lastIndex = 0;
+  return result.replace(URL_USERINFO_PATTERN, `$1${placeholder}@`);
 }
 function sanitizeErrorDetails(text, apiKey, placeholder = REDACTED_KEY_PLACEHOLDER) {
   if (text === "") return "";
@@ -40,9 +48,6 @@ function sanitizeErrorDetails(text, apiKey, placeholder = REDACTED_KEY_PLACEHOLD
     result = result.replaceAll(apiKey.trim(), placeholder);
   }
   result = sanitizeOutput(result, placeholder);
-  result = result.replace(/https?:\/\/[^\s/@]+@[^\s/]+/g, (match) => {
-    return match.replace(/https?:\/\/[^\s/@]+@/, `https://${placeholder}@`);
-  });
   result = result.replace(/(authorization:\s*bearer\s+)\S+/gi, `$1${placeholder}`);
   result = result.replace(/(authorization:\s*basic\s+)\S+/gi, `$1${placeholder}`);
   result = result.replace(/(bearer\s+)[A-Za-z0-9._~+/-]+=*/gi, `$1${placeholder}`);
@@ -57,9 +62,29 @@ function sanitizeErrorDetails(text, apiKey, placeholder = REDACTED_KEY_PLACEHOLD
   );
   return result;
 }
+function serializedForm(value) {
+  if (typeof value !== "object" || value === null) return value;
+  const toJSON = value.toJSON;
+  return typeof toJSON === "function" ? toJSON.call(value) : value;
+}
+function sanitizeStringLeaves(input, sanitize) {
+  const value = serializedForm(input);
+  if (typeof value === "string") return sanitize(value);
+  if (Array.isArray(value)) return value.map((item) => sanitizeStringLeaves(item, sanitize));
+  if (typeof value === "object" && value !== null) {
+    const copy = {};
+    for (const [key, entry] of Object.entries(value)) {
+      copy[key] = sanitizeStringLeaves(entry, sanitize);
+    }
+    return copy;
+  }
+  return value;
+}
 
 export {
+  REDACTED_KEY_PLACEHOLDER,
   sanitizeOutput,
-  sanitizeErrorDetails
+  sanitizeErrorDetails,
+  sanitizeStringLeaves
 };
-//# sourceMappingURL=chunk-2NDA4DHW.js.map
+//# sourceMappingURL=chunk-37GZJOQE.js.map

package/dist/chunk-37GZJOQE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/output-sanitizer.ts"],"sourcesContent":["/**\n * nexus-agents/security - Output Sanitizer\n *\n * Redacts API keys and tokens from CLI subprocess stdout/stderr\n * before the output is returned, logged, or traced.\n *\n * @module security/output-sanitizer\n * (Source: Issue #1597 — subprocess output scrubbing gap)\n */\n\n/** Placeholder text that replaces redacted keys. */\nexport const REDACTED_KEY_PLACEHOLDER = '[REDACTED_KEY]';\n\n/**\n * Patterns matching known API key formats.\n *\n * Order matters: more-specific prefixes (sk-ant-, sk-proj-) come before\n * the generic sk-* pattern so they match first.\n *\n * Each pattern requires a minimum token length after the prefix to avoid\n * false positives on short strings like \"sk-ab\".\n */\nconst KEY_PATTERNS: readonly RegExp[] = [\n  // Anthropic: sk-ant-api03-... (at least 20 chars after prefix)\n  /sk-ant-[A-Za-z0-9_-]{20,}/g,\n  // OpenAI project: sk-proj-... (at least 20 chars after prefix)\n  /sk-proj-[A-Za-z0-9_-]{20,}/g,\n  // Generic OpenAI: sk-... (at least 20 chars after prefix)\n  /sk-[A-Za-z0-9_-]{20,}/g,\n  // Public keys: pk-...\n  /pk-[A-Za-z0-9_-]{20,}/g,\n  // AWS access key ID\n  /\\bAKIA[A-Z0-9]{16}\\b/g,\n  // Google AI / Gemini: AIzaSy... (at least 30 chars total)\n  /AIzaSy[A-Za-z0-9_-]{24,}/g,\n  // GitHub PAT: ghp_...\n  /ghp_[A-Za-z0-9]{20,}/g,\n  // GitHub OAuth: gho_...\n  /gho_[A-Za-z0-9]{20,}/g,\n  // GitHub user-to-server: ghu_...\n  /ghu_[A-Za-z0-9]{20,}/g,\n  // GitHub server-to-server (app installation): ghs_...\n  /ghs_[A-Za-z0-9]{20,}/g,\n  // GitHub fine-grained PAT: github_pat_...\n  /github_pat_[A-Za-z0-9_]{22,}/g,\n  // GitLab PAT: glpat-...\n  /glpat-[A-Za-z0-9_-]{10,}/g,\n  // npm token: npm_...\n  /npm_[A-Za-z0-9]{20,}/g,\n  // PyPI token: pypi-...\n  /pypi-[A-Za-z0-9_-]{20,}/g,\n];\n\n/**\n * URL userinfo: `scheme://user:pass@` or `scheme://token@`. Group 1 is the\n * scheme, kept so the redacted URL still names its host. The user part\n * excludes `:` and both parts exclude `/?#@` and whitespace, so a port\n * (`host:8080/…`) or an `@` in a path or query is never taken for\n * credentials. Bounded quantifiers keep the match linear.\n */\nconst URL_USERINFO_PATTERN =\n  /\\b([a-z][a-z0-9+.-]{0,31}:\\/\\/)[^\\s/?#@:]{0,256}(?::[^\\s/?#@]{0,256})?@/gi;\n\n/**\n * Redacts known API key patterns from a string.\n *\n * Designed to be called on subprocess stdout/stderr before the output\n * is returned to callers, written to logs, or included in trace data.\n *\n * @param text - Raw subprocess output\n * @param placeholder - Replacement placeholder (default: [REDACTED_KEY])\n * @returns The same text with API keys replaced by placeholder\n */\nexport function sanitizeOutput(\n  text: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return text;\n\n  let result = text;\n  for (const pattern of KEY_PATTERNS) {\n    // Reset lastIndex for global regex reuse\n    pattern.lastIndex = 0;\n    result = result.replace(pattern, placeholder);\n  }\n  URL_USERINFO_PATTERN.lastIndex = 0;\n  return result.replace(URL_USERINFO_PATTERN, `$1${placeholder}@`);\n}\n\n/**\n * Redacts credentials (API keys, authorization headers, Bearer tokens, URL credentials,\n * and sensitive JSON fields) from error messages and response bodies.\n *\n * Designed to be called on upstream API error representations before they are\n * attached to error envelopes, logged, or returned to callers.\n *\n * @param text - Raw error message or serialized error body\n * @param apiKey - Optional configured API key to redact by exact match\n * @returns The sanitized text with credentials redacted\n */\nexport function sanitizeErrorDetails(\n  text: string,\n  apiKey?: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return '';\n\n  let result = text;\n  if (apiKey !== undefined && apiKey.trim() !== '') {\n    result = result.replaceAll(apiKey.trim(), placeholder);\n  }\n\n  // Redact known key patterns and URL credentials (user:pass@ / token@)\n  result = sanitizeOutput(result, placeholder);\n\n  // Redact Authorization headers: Bearer and Basic tokens\n  result = result.replace(/(authorization:\\s*bearer\\s+)\\S+/gi, `$1${placeholder}`);\n  result = result.replace(/(authorization:\\s*basic\\s+)\\S+/gi, `$1${placeholder}`);\n  result = result.replace(/(bearer\\s+)[A-Za-z0-9._~+/-]+=*/gi, `$1${placeholder}`);\n\n  // Redact plain text assignments like password=... or secret: ...\n  result = result.replace(/(\\b(?:password|passwd|secret)\\s*[=:]\\s*)\\S{4,}/gi, `$1${placeholder}`);\n\n  // Redact sensitive query parameters in URLs or logs (?api_key=..., &token=..., &prompt=...)\n  result = result.replace(\n    /([?&](?:api[_-]?key|token|access[_-]?token|secret|password|prompt|system_prompt|user_prompt)=)[^&\\s]+/gi,\n    `$1${placeholder}`\n  );\n\n  // Redact sensitive JSON keys: \"api_key\": \"...\", \"token\": \"...\", \"prompt\": \"...\", etc.\n  result = result.replace(\n    /\"(api[_-]?key|access[_-]?token|token|secret|password|prompt|system_prompt|user_prompt)\"\\s*:\\s*\"(?:[^\"\\\\]|\\\\.)*\"/gi,\n    `\"$1\": \"${placeholder}\"`\n  );\n\n  return result;\n}\n\n/** `value.toJSON()` when it has one (a `Date`), as `JSON.stringify` would; else `value`. */\nfunction serializedForm(value: unknown): unknown {\n  if (typeof value !== 'object' || value === null) return value;\n  const toJSON: unknown = (value as { toJSON?: unknown }).toJSON;\n  return typeof toJSON === 'function' ? (toJSON as () => unknown).call(value) : value;\n}\n\n/**\n * `value` with `sanitize` applied to every string LEAF. A `toJSON` object (a\n * `Date`) is taken in its serialized form first, as `JSON.stringify` would;\n * arrays are mapped and objects copied from their own enumerable entries.\n * Keys, numbers, booleans and `null` are untouched, so the structure a JSON\n * reader sees survives. Returns a copy — the input is not mutated.\n */\nexport function sanitizeStringLeaves(input: unknown, sanitize: (text: string) => string): unknown {\n  const value = serializedForm(input);\n  if (typeof value === 'string') return sanitize(value);\n  if (Array.isArray(value)) return value.map((item) => sanitizeStringLeaves(item, sanitize));\n  if (typeof value === 'object' && value !== null) {\n    const copy: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value)) {\n      copy[key] = sanitizeStringLeaves(entry, sanitize);\n    }\n    return copy;\n  }\n  return value;\n}\n"],"mappings":";AAWO,IAAM,2BAA2B;AAWxC,IAAM,eAAkC;AAAA;AAAA,EAEtC;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AACF;AASA,IAAM,uBACJ;AAYK,SAAS,eACd,MACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,MAAI,SAAS;AACb,aAAW,WAAW,cAAc;AAElC,YAAQ,YAAY;AACpB,aAAS,OAAO,QAAQ,SAAS,WAAW;AAAA,EAC9C;AACA,uBAAqB,YAAY;AACjC,SAAO,OAAO,QAAQ,sBAAsB,KAAK,WAAW,GAAG;AACjE;AAaO,SAAS,qBACd,MACA,QACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,MAAI,SAAS;AACb,MAAI,WAAW,UAAa,OAAO,KAAK,MAAM,IAAI;AAChD,aAAS,OAAO,WAAW,OAAO,KAAK,GAAG,WAAW;AAAA,EACvD;AAGA,WAAS,eAAe,QAAQ,WAAW;AAG3C,WAAS,OAAO,QAAQ,qCAAqC,KAAK,WAAW,EAAE;AAC/E,WAAS,OAAO,QAAQ,oCAAoC,KAAK,WAAW,EAAE;AAC9E,WAAS,OAAO,QAAQ,qCAAqC,KAAK,WAAW,EAAE;AAG/E,WAAS,OAAO,QAAQ,oDAAoD,KAAK,WAAW,EAAE;AAG9F,WAAS,OAAO;AAAA,IACd;AAAA,IACA,KAAK,WAAW;AAAA,EAClB;AAGA,WAAS,OAAO;AAAA,IACd;AAAA,IACA,UAAU,WAAW;AAAA,EACvB;AAEA,SAAO;AACT;AAGA,SAAS,eAAe,OAAyB;AAC/C,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAmB,MAA+B;AACxD,SAAO,OAAO,WAAW,aAAc,OAAyB,KAAK,KAAK,IAAI;AAChF;AASO,SAAS,qBAAqB,OAAgB,UAA6C;AAChG,QAAM,QAAQ,eAAe,KAAK;AAClC,MAAI,OAAO,UAAU,SAAU,QAAO,SAAS,KAAK;AACpD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,qBAAqB,MAAM,QAAQ,CAAC;AACzF,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,WAAK,GAAG,IAAI,qBAAqB,OAAO,QAAQ;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-XIQSMZ2B.js → chunk-3DMMPHEZ.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "node:child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-XIQSMZ2B.js.map
+//# sourceMappingURL=chunk-3DMMPHEZ.js.map

package/dist/{chunk-7SM3L43A.js → chunk-4E5KLHUM.js}

@@ -1,9 +1,9 @@
 import {
   loadPapersRegistry
-} from "./chunk-5FEDDPEN.js";
+} from "./chunk-A3NV45KD.js";
 import {
   getErrorMessage
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/cli/research-helpers-synthesize.ts
 import { z } from "zod";
@@ -876,4 +876,4 @@ export {
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=chunk-7SM3L43A.js.map
+//# sourceMappingURL=chunk-4E5KLHUM.js.map

package/dist/{chunk-AAXQHX6P.js → chunk-5CK27FJM.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -610,4 +610,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-AAXQHX6P.js.map
+//# sourceMappingURL=chunk-5CK27FJM.js.map

package/dist/{chunk-X2KQAEWB.js → chunk-5CMHNRPS.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-MPMIQSAR.js";
+} from "./chunk-Q4VLKRB4.js";
 import {
   ROLE_DEFAULT_TRUST,
   ReputationCache,
@@ -12,10 +12,10 @@ import {
   resolveEnvMode,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-AAXQHX6P.js";
+} from "./chunk-5CK27FJM.js";
 import {
   hasToken
-} from "./chunk-XIQSMZ2B.js";
+} from "./chunk-3DMMPHEZ.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   createLogger,
@@ -23,7 +23,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/security/firewall/firewall-policy-mode.ts
 import { z } from "zod";
@@ -2650,4 +2650,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-X2KQAEWB.js.map
+//# sourceMappingURL=chunk-5CMHNRPS.js.map

package/dist/{chunk-LB3HC45L.js → chunk-5TSGLULY.js}

@@ -13,7 +13,7 @@ import {
   observedArmDisplaySlot,
   ok,
   parseRetryAfterMs
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 
 // src/cli-adapters/circuit-breaker-types.ts
 var CircuitErrorCode = {
@@ -682,6 +682,7 @@ export {
   CliCircuitBreaker,
   mapModelErrorToCategory,
   isCallerCancelled,
+  isTimeoutAbortReason,
   raceAbort,
   RETRYABLE_ERROR_CODES,
   isTimeoutText,
@@ -694,4 +695,4 @@ export {
   CliCircuitBreakerIntegration,
   createCliCircuitBreakerIntegration
 };
-//# sourceMappingURL=chunk-LB3HC45L.js.map
+//# sourceMappingURL=chunk-5TSGLULY.js.map

package/dist/{chunk-LOSHQDR5.js → chunk-6JFXJWB5.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-A35D54GB.js";
+} from "./chunk-CT6GAHMH.js";
 import {
   resolveInsideRoot
 } from "./chunk-XEPZSDN5.js";
@@ -8,8 +8,9 @@ import {
   DEFAULT_EXECUTION_MODE
 } from "./chunk-ECJ52NSK.js";
 import {
-  sanitizeErrorDetails
-} from "./chunk-2NDA4DHW.js";
+  sanitizeErrorDetails,
+  sanitizeStringLeaves
+} from "./chunk-37GZJOQE.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -26,7 +27,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-4AVYG4NB.js";
+} from "./chunk-RTH5A2UF.js";
 import {
   getNexusDataDir,
   parseBoolValue
@@ -1244,22 +1245,10 @@ function sanitizeOutput(text, logger) {
   }
   return sanitized;
 }
-function sanitizeDeep(value, logger) {
-  if (typeof value === "string") {
-    return sanitizeOutput(value, logger);
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => sanitizeDeep(item, logger));
-  }
-  if (typeof value === "object" && value !== null) {
-    return sanitizeDeepRecord(value, logger);
-  }
-  return value;
-}
 function sanitizeDeepRecord(obj, logger) {
   const result = {};
   for (const [key, val] of Object.entries(obj)) {
-    result[key] = sanitizeDeep(val, logger);
+    result[key] = sanitizeStringLeaves(val, (text) => sanitizeOutput(text, logger));
   }
   return result;
 }
@@ -2340,4 +2329,4 @@ export {
   DEFAULT_CONSENSUS_CONFIG,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-LOSHQDR5.js.map
+//# sourceMappingURL=chunk-6JFXJWB5.js.map