nexus-agents 8.108.1 → 8.110.0

package/dist/{ast-rule-runner-KZMBJQLP.js → ast-rule-runner-ZO3T66KP.js}

@@ -9,9 +9,9 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-N6KPLEMJ.js";
+} from "./chunk-CDPPWCGO.js";
 import "./chunk-XEPZSDN5.js";
-import "./chunk-RTH5A2UF.js";
+import "./chunk-RIF7TUYH.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -27,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-KZMBJQLP.js.map
+//# sourceMappingURL=ast-rule-runner-ZO3T66KP.js.map

package/dist/{child-mcp-config-IB73HXHT.js → child-mcp-config-M4MRFMP3.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-RTH5A2UF.js";
+} from "./chunk-RIF7TUYH.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -56,4 +56,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-IB73HXHT.js.map
+//# sourceMappingURL=child-mcp-config-M4MRFMP3.js.map

package/dist/{chunk-37GZJOQE.js → chunk-22AF7TYV.js}

@@ -1,45 +1,12 @@
+import {
+  redactCredentialShapes
+} from "./chunk-RIF7TUYH.js";
+
 // src/security/output-sanitizer.ts
 var REDACTED_KEY_PLACEHOLDER = "[REDACTED_KEY]";
-var KEY_PATTERNS = [
-  // Anthropic: sk-ant-api03-... (at least 20 chars after prefix)
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  // OpenAI project: sk-proj-... (at least 20 chars after prefix)
-  /sk-proj-[A-Za-z0-9_-]{20,}/g,
-  // Generic OpenAI: sk-... (at least 20 chars after prefix)
-  /sk-[A-Za-z0-9_-]{20,}/g,
-  // Public keys: pk-...
-  /pk-[A-Za-z0-9_-]{20,}/g,
-  // AWS access key ID
-  /\bAKIA[A-Z0-9]{16}\b/g,
-  // Google AI / Gemini: AIzaSy... (at least 30 chars total)
-  /AIzaSy[A-Za-z0-9_-]{24,}/g,
-  // GitHub PAT: ghp_...
-  /ghp_[A-Za-z0-9]{20,}/g,
-  // GitHub OAuth: gho_...
-  /gho_[A-Za-z0-9]{20,}/g,
-  // GitHub user-to-server: ghu_...
-  /ghu_[A-Za-z0-9]{20,}/g,
-  // GitHub server-to-server (app installation): ghs_...
-  /ghs_[A-Za-z0-9]{20,}/g,
-  // GitHub fine-grained PAT: github_pat_...
-  /github_pat_[A-Za-z0-9_]{22,}/g,
-  // GitLab PAT: glpat-...
-  /glpat-[A-Za-z0-9_-]{10,}/g,
-  // npm token: npm_...
-  /npm_[A-Za-z0-9]{20,}/g,
-  // PyPI token: pypi-...
-  /pypi-[A-Za-z0-9_-]{20,}/g
-];
-var URL_USERINFO_PATTERN = /\b([a-z][a-z0-9+.-]{0,31}:\/\/)[^\s/?#@:]{0,256}(?::[^\s/?#@]{0,256})?@/gi;
 function sanitizeOutput(text, placeholder = REDACTED_KEY_PLACEHOLDER) {
   if (text === "") return text;
-  let result = text;
-  for (const pattern of KEY_PATTERNS) {
-    pattern.lastIndex = 0;
-    result = result.replace(pattern, placeholder);
-  }
-  URL_USERINFO_PATTERN.lastIndex = 0;
-  return result.replace(URL_USERINFO_PATTERN, `$1${placeholder}@`);
+  return redactCredentialShapes(text, placeholder);
 }
 function sanitizeErrorDetails(text, apiKey, placeholder = REDACTED_KEY_PLACEHOLDER) {
   if (text === "") return "";
@@ -87,4 +54,4 @@ export {
   sanitizeErrorDetails,
   sanitizeStringLeaves
 };
-//# sourceMappingURL=chunk-37GZJOQE.js.map
+//# sourceMappingURL=chunk-22AF7TYV.js.map

package/dist/chunk-22AF7TYV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/output-sanitizer.ts"],"sourcesContent":["/**\n * nexus-agents/security - Output Sanitizer\n *\n * Redacts API keys and tokens from CLI subprocess stdout/stderr\n * before the output is returned, logged, or traced.\n *\n * @module security/output-sanitizer\n * (Source: Issue #1597 — subprocess output scrubbing gap)\n */\n\nimport { redactCredentialShapes } from '../core/credential-patterns.js';\n\n/** Placeholder text that replaces redacted keys. */\nexport const REDACTED_KEY_PLACEHOLDER = '[REDACTED_KEY]';\n\n/**\n * Redacts known API key patterns from a string: the shared credential-shape\n * set (`core/credential-patterns`, #6753) and URL userinfo. Context rules\n * (Authorization headers, `password=`, query and JSON fields) are NOT applied\n * here — subprocess output is prose, where they misfire (`bearer\\s+` takes\n * \"the bearer of\"); they are the local\n * extension {@link sanitizeErrorDetails} adds for upstream error bodies.\n *\n * Designed to be called on subprocess stdout/stderr before the output\n * is returned to callers, written to logs, or included in trace data.\n *\n * @param text - Raw subprocess output\n * @param placeholder - Replacement placeholder (default: [REDACTED_KEY])\n * @returns The same text with API keys replaced by placeholder\n */\nexport function sanitizeOutput(\n  text: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return text;\n\n  return redactCredentialShapes(text, placeholder);\n}\n\n/**\n * Redacts credentials (API keys, authorization headers, Bearer tokens, URL credentials,\n * and sensitive JSON fields) from error messages and response bodies.\n *\n * Designed to be called on upstream API error representations before they are\n * attached to error envelopes, logged, or returned to callers.\n *\n * @param text - Raw error message or serialized error body\n * @param apiKey - Optional configured API key to redact by exact match\n * @returns The sanitized text with credentials redacted\n */\nexport function sanitizeErrorDetails(\n  text: string,\n  apiKey?: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return '';\n\n  let result = text;\n  if (apiKey !== undefined && apiKey.trim() !== '') {\n    result = result.replaceAll(apiKey.trim(), placeholder);\n  }\n\n  // Redact known key patterns and URL credentials (user:pass@ / token@)\n  result = sanitizeOutput(result, placeholder);\n\n  // Redact Authorization headers: Bearer and Basic tokens\n  result = result.replace(/(authorization:\\s*bearer\\s+)\\S+/gi, `$1${placeholder}`);\n  result = result.replace(/(authorization:\\s*basic\\s+)\\S+/gi, `$1${placeholder}`);\n  result = result.replace(/(bearer\\s+)[A-Za-z0-9._~+/-]+=*/gi, `$1${placeholder}`);\n\n  // Redact plain text assignments like password=... or secret: ...\n  result = result.replace(/(\\b(?:password|passwd|secret)\\s*[=:]\\s*)\\S{4,}/gi, `$1${placeholder}`);\n\n  // Redact sensitive query parameters in URLs or logs (?api_key=..., &token=..., &prompt=...)\n  result = result.replace(\n    /([?&](?:api[_-]?key|token|access[_-]?token|secret|password|prompt|system_prompt|user_prompt)=)[^&\\s]+/gi,\n    `$1${placeholder}`\n  );\n\n  // Redact sensitive JSON keys: \"api_key\": \"...\", \"token\": \"...\", \"prompt\": \"...\", etc.\n  result = result.replace(\n    /\"(api[_-]?key|access[_-]?token|token|secret|password|prompt|system_prompt|user_prompt)\"\\s*:\\s*\"(?:[^\"\\\\]|\\\\.)*\"/gi,\n    `\"$1\": \"${placeholder}\"`\n  );\n\n  return result;\n}\n\n/** `value.toJSON()` when it has one (a `Date`), as `JSON.stringify` would; else `value`. */\nfunction serializedForm(value: unknown): unknown {\n  if (typeof value !== 'object' || value === null) return value;\n  const toJSON: unknown = (value as { toJSON?: unknown }).toJSON;\n  return typeof toJSON === 'function' ? (toJSON as () => unknown).call(value) : value;\n}\n\n/**\n * `value` with `sanitize` applied to every string LEAF. A `toJSON` object (a\n * `Date`) is taken in its serialized form first, as `JSON.stringify` would;\n * arrays are mapped and objects copied from their own enumerable entries.\n * Keys, numbers, booleans and `null` are untouched, so the structure a JSON\n * reader sees survives. Returns a copy — the input is not mutated.\n */\nexport function sanitizeStringLeaves(input: unknown, sanitize: (text: string) => string): unknown {\n  const value = serializedForm(input);\n  if (typeof value === 'string') return sanitize(value);\n  if (Array.isArray(value)) return value.map((item) => sanitizeStringLeaves(item, sanitize));\n  if (typeof value === 'object' && value !== null) {\n    const copy: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value)) {\n      copy[key] = sanitizeStringLeaves(entry, sanitize);\n    }\n    return copy;\n  }\n  return value;\n}\n"],"mappings":";;;;;AAaO,IAAM,2BAA2B;AAiBjC,SAAS,eACd,MACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,SAAO,uBAAuB,MAAM,WAAW;AACjD;AAaO,SAAS,qBACd,MACA,QACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,MAAI,SAAS;AACb,MAAI,WAAW,UAAa,OAAO,KAAK,MAAM,IAAI;AAChD,aAAS,OAAO,WAAW,OAAO,KAAK,GAAG,WAAW;AAAA,EACvD;AAGA,WAAS,eAAe,QAAQ,WAAW;AAG3C,WAAS,OAAO,QAAQ,qCAAqC,KAAK,WAAW,EAAE;AAC/E,WAAS,OAAO,QAAQ,oCAAoC,KAAK,WAAW,EAAE;AAC9E,WAAS,OAAO,QAAQ,qCAAqC,KAAK,WAAW,EAAE;AAG/E,WAAS,OAAO,QAAQ,oDAAoD,KAAK,WAAW,EAAE;AAG9F,WAAS,OAAO;AAAA,IACd;AAAA,IACA,KAAK,WAAW;AAAA,EAClB;AAGA,WAAS,OAAO;AAAA,IACd;AAAA,IACA,UAAU,WAAW;AAAA,EACvB;AAEA,SAAO;AACT;AAGA,SAAS,eAAe,OAAyB;AAC/C,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAmB,MAA+B;AACxD,SAAO,OAAO,WAAW,aAAc,OAAyB,KAAK,KAAK,IAAI;AAChF;AASO,SAAS,qBAAqB,OAAgB,UAA6C;AAChG,QAAM,QAAQ,eAAe,KAAK;AAClC,MAAI,OAAO,UAAU,SAAU,QAAO,SAAS,KAAK;AACpD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,qBAAqB,MAAM,QAAQ,CAAC;AACzF,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,WAAK,GAAG,IAAI,qBAAqB,OAAO,QAAQ;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}