nexus-agents 8.109.0 → 8.110.0

package/dist/{ast-rule-runner-IIUVSV4U.js → ast-rule-runner-ZO3T66KP.js}

@@ -9,9 +9,9 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-WWOKQDED.js";
+} from "./chunk-CDPPWCGO.js";
 import "./chunk-XEPZSDN5.js";
-import "./chunk-XKRHWU5P.js";
+import "./chunk-RIF7TUYH.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -27,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-IIUVSV4U.js.map
+//# sourceMappingURL=ast-rule-runner-ZO3T66KP.js.map

package/dist/{child-mcp-config-SDWFHROT.js → child-mcp-config-M4MRFMP3.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -56,4 +56,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-SDWFHROT.js.map
+//# sourceMappingURL=child-mcp-config-M4MRFMP3.js.map

package/dist/{chunk-37GZJOQE.js → chunk-22AF7TYV.js}

@@ -1,45 +1,12 @@
+import {
+  redactCredentialShapes
+} from "./chunk-RIF7TUYH.js";
+
 // src/security/output-sanitizer.ts
 var REDACTED_KEY_PLACEHOLDER = "[REDACTED_KEY]";
-var KEY_PATTERNS = [
-  // Anthropic: sk-ant-api03-... (at least 20 chars after prefix)
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  // OpenAI project: sk-proj-... (at least 20 chars after prefix)
-  /sk-proj-[A-Za-z0-9_-]{20,}/g,
-  // Generic OpenAI: sk-... (at least 20 chars after prefix)
-  /sk-[A-Za-z0-9_-]{20,}/g,
-  // Public keys: pk-...
-  /pk-[A-Za-z0-9_-]{20,}/g,
-  // AWS access key ID
-  /\bAKIA[A-Z0-9]{16}\b/g,
-  // Google AI / Gemini: AIzaSy... (at least 30 chars total)
-  /AIzaSy[A-Za-z0-9_-]{24,}/g,
-  // GitHub PAT: ghp_...
-  /ghp_[A-Za-z0-9]{20,}/g,
-  // GitHub OAuth: gho_...
-  /gho_[A-Za-z0-9]{20,}/g,
-  // GitHub user-to-server: ghu_...
-  /ghu_[A-Za-z0-9]{20,}/g,
-  // GitHub server-to-server (app installation): ghs_...
-  /ghs_[A-Za-z0-9]{20,}/g,
-  // GitHub fine-grained PAT: github_pat_...
-  /github_pat_[A-Za-z0-9_]{22,}/g,
-  // GitLab PAT: glpat-...
-  /glpat-[A-Za-z0-9_-]{10,}/g,
-  // npm token: npm_...
-  /npm_[A-Za-z0-9]{20,}/g,
-  // PyPI token: pypi-...
-  /pypi-[A-Za-z0-9_-]{20,}/g
-];
-var URL_USERINFO_PATTERN = /\b([a-z][a-z0-9+.-]{0,31}:\/\/)[^\s/?#@:]{0,256}(?::[^\s/?#@]{0,256})?@/gi;
 function sanitizeOutput(text, placeholder = REDACTED_KEY_PLACEHOLDER) {
   if (text === "") return text;
-  let result = text;
-  for (const pattern of KEY_PATTERNS) {
-    pattern.lastIndex = 0;
-    result = result.replace(pattern, placeholder);
-  }
-  URL_USERINFO_PATTERN.lastIndex = 0;
-  return result.replace(URL_USERINFO_PATTERN, `$1${placeholder}@`);
+  return redactCredentialShapes(text, placeholder);
 }
 function sanitizeErrorDetails(text, apiKey, placeholder = REDACTED_KEY_PLACEHOLDER) {
   if (text === "") return "";
@@ -87,4 +54,4 @@ export {
   sanitizeErrorDetails,
   sanitizeStringLeaves
 };
-//# sourceMappingURL=chunk-37GZJOQE.js.map
+//# sourceMappingURL=chunk-22AF7TYV.js.map

package/dist/chunk-22AF7TYV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/output-sanitizer.ts"],"sourcesContent":["/**\n * nexus-agents/security - Output Sanitizer\n *\n * Redacts API keys and tokens from CLI subprocess stdout/stderr\n * before the output is returned, logged, or traced.\n *\n * @module security/output-sanitizer\n * (Source: Issue #1597 — subprocess output scrubbing gap)\n */\n\nimport { redactCredentialShapes } from '../core/credential-patterns.js';\n\n/** Placeholder text that replaces redacted keys. */\nexport const REDACTED_KEY_PLACEHOLDER = '[REDACTED_KEY]';\n\n/**\n * Redacts known API key patterns from a string: the shared credential-shape\n * set (`core/credential-patterns`, #6753) and URL userinfo. Context rules\n * (Authorization headers, `password=`, query and JSON fields) are NOT applied\n * here — subprocess output is prose, where they misfire (`bearer\\s+` takes\n * \"the bearer of\"); they are the local\n * extension {@link sanitizeErrorDetails} adds for upstream error bodies.\n *\n * Designed to be called on subprocess stdout/stderr before the output\n * is returned to callers, written to logs, or included in trace data.\n *\n * @param text - Raw subprocess output\n * @param placeholder - Replacement placeholder (default: [REDACTED_KEY])\n * @returns The same text with API keys replaced by placeholder\n */\nexport function sanitizeOutput(\n  text: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return text;\n\n  return redactCredentialShapes(text, placeholder);\n}\n\n/**\n * Redacts credentials (API keys, authorization headers, Bearer tokens, URL credentials,\n * and sensitive JSON fields) from error messages and response bodies.\n *\n * Designed to be called on upstream API error representations before they are\n * attached to error envelopes, logged, or returned to callers.\n *\n * @param text - Raw error message or serialized error body\n * @param apiKey - Optional configured API key to redact by exact match\n * @returns The sanitized text with credentials redacted\n */\nexport function sanitizeErrorDetails(\n  text: string,\n  apiKey?: string,\n  placeholder: string = REDACTED_KEY_PLACEHOLDER\n): string {\n  if (text === '') return '';\n\n  let result = text;\n  if (apiKey !== undefined && apiKey.trim() !== '') {\n    result = result.replaceAll(apiKey.trim(), placeholder);\n  }\n\n  // Redact known key patterns and URL credentials (user:pass@ / token@)\n  result = sanitizeOutput(result, placeholder);\n\n  // Redact Authorization headers: Bearer and Basic tokens\n  result = result.replace(/(authorization:\\s*bearer\\s+)\\S+/gi, `$1${placeholder}`);\n  result = result.replace(/(authorization:\\s*basic\\s+)\\S+/gi, `$1${placeholder}`);\n  result = result.replace(/(bearer\\s+)[A-Za-z0-9._~+/-]+=*/gi, `$1${placeholder}`);\n\n  // Redact plain text assignments like password=... or secret: ...\n  result = result.replace(/(\\b(?:password|passwd|secret)\\s*[=:]\\s*)\\S{4,}/gi, `$1${placeholder}`);\n\n  // Redact sensitive query parameters in URLs or logs (?api_key=..., &token=..., &prompt=...)\n  result = result.replace(\n    /([?&](?:api[_-]?key|token|access[_-]?token|secret|password|prompt|system_prompt|user_prompt)=)[^&\\s]+/gi,\n    `$1${placeholder}`\n  );\n\n  // Redact sensitive JSON keys: \"api_key\": \"...\", \"token\": \"...\", \"prompt\": \"...\", etc.\n  result = result.replace(\n    /\"(api[_-]?key|access[_-]?token|token|secret|password|prompt|system_prompt|user_prompt)\"\\s*:\\s*\"(?:[^\"\\\\]|\\\\.)*\"/gi,\n    `\"$1\": \"${placeholder}\"`\n  );\n\n  return result;\n}\n\n/** `value.toJSON()` when it has one (a `Date`), as `JSON.stringify` would; else `value`. */\nfunction serializedForm(value: unknown): unknown {\n  if (typeof value !== 'object' || value === null) return value;\n  const toJSON: unknown = (value as { toJSON?: unknown }).toJSON;\n  return typeof toJSON === 'function' ? (toJSON as () => unknown).call(value) : value;\n}\n\n/**\n * `value` with `sanitize` applied to every string LEAF. A `toJSON` object (a\n * `Date`) is taken in its serialized form first, as `JSON.stringify` would;\n * arrays are mapped and objects copied from their own enumerable entries.\n * Keys, numbers, booleans and `null` are untouched, so the structure a JSON\n * reader sees survives. Returns a copy — the input is not mutated.\n */\nexport function sanitizeStringLeaves(input: unknown, sanitize: (text: string) => string): unknown {\n  const value = serializedForm(input);\n  if (typeof value === 'string') return sanitize(value);\n  if (Array.isArray(value)) return value.map((item) => sanitizeStringLeaves(item, sanitize));\n  if (typeof value === 'object' && value !== null) {\n    const copy: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value)) {\n      copy[key] = sanitizeStringLeaves(entry, sanitize);\n    }\n    return copy;\n  }\n  return value;\n}\n"],"mappings":";;;;;AAaO,IAAM,2BAA2B;AAiBjC,SAAS,eACd,MACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,SAAO,uBAAuB,MAAM,WAAW;AACjD;AAaO,SAAS,qBACd,MACA,QACA,cAAsB,0BACd;AACR,MAAI,SAAS,GAAI,QAAO;AAExB,MAAI,SAAS;AACb,MAAI,WAAW,UAAa,OAAO,KAAK,MAAM,IAAI;AAChD,aAAS,OAAO,WAAW,OAAO,KAAK,GAAG,WAAW;AAAA,EACvD;AAGA,WAAS,eAAe,QAAQ,WAAW;AAG3C,WAAS,OAAO,QAAQ,qCAAqC,KAAK,WAAW,EAAE;AAC/E,WAAS,OAAO,QAAQ,oCAAoC,KAAK,WAAW,EAAE;AAC9E,WAAS,OAAO,QAAQ,qCAAqC,KAAK,WAAW,EAAE;AAG/E,WAAS,OAAO,QAAQ,oDAAoD,KAAK,WAAW,EAAE;AAG9F,WAAS,OAAO;AAAA,IACd;AAAA,IACA,KAAK,WAAW;AAAA,EAClB;AAGA,WAAS,OAAO;AAAA,IACd;AAAA,IACA,UAAU,WAAW;AAAA,EACvB;AAEA,SAAO;AACT;AAGA,SAAS,eAAe,OAAyB;AAC/C,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAmB,MAA+B;AACxD,SAAO,OAAO,WAAW,aAAc,OAAyB,KAAK,KAAK,IAAI;AAChF;AASO,SAAS,qBAAqB,OAAgB,UAA6C;AAChG,QAAM,QAAQ,eAAe,KAAK;AAClC,MAAI,OAAO,UAAU,SAAU,QAAO,SAAS,KAAK;AACpD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,qBAAqB,MAAM,QAAQ,CAAC;AACzF,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,WAAK,GAAG,IAAI,qBAAqB,OAAO,QAAQ;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-B46ICMSM.js → chunk-33OFW2GU.js}

@@ -6,13 +6,13 @@ import {
   createGraphAuditBridge,
   emitPipelinePolicyEvent,
   readActionRefusal
-} from "./chunk-SBW2C6Z2.js";
+} from "./chunk-GCQLEDCY.js";
 import {
   withPrerequisite
-} from "./chunk-GCWFVDAM.js";
+} from "./chunk-AG2XK7CQ.js";
 import {
   generateSecurityPlan
-} from "./chunk-PFJ5KNLC.js";
+} from "./chunk-U5TT4C5O.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-4GDMHCKX.js";
@@ -32,14 +32,14 @@ import {
 } from "./chunk-WDAND5YU.js";
 import {
   sanitizeInput
-} from "./chunk-F65I2L2L.js";
+} from "./chunk-YLQNJAJP.js";
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-IS2ZE5WQ.js";
+} from "./chunk-OTIVROWE.js";
 import {
   executeExpert
-} from "./chunk-4OIS5PWM.js";
+} from "./chunk-CX3YZ4S6.js";
 import {
   DEPRECATED_MODE_ALIAS_INPUT,
   JobStatusSchema,
@@ -92,7 +92,7 @@ import {
   withFileLock,
   withWarnings,
   writeJobCancelled
-} from "./chunk-WSE6K4FV.js";
+} from "./chunk-FOBWXDHO.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -120,31 +120,31 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-JEVYS4AL.js";
+} from "./chunk-SWHKENEB.js";
 import {
   VERSION
-} from "./chunk-HBIWYCXN.js";
+} from "./chunk-PLNSFL2K.js";
 import {
   allOf,
   anyOf
 } from "./chunk-EZNIYU5T.js";
 import {
   isGatewayModelAdapter
-} from "./chunk-ZBF7CSLQ.js";
+} from "./chunk-BJJOZV7O.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-S242UP7R.js";
+} from "./chunk-NBSI5ICR.js";
 import {
   EventTopics,
   UNRESOLVED_MODEL_ID,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-LBXRT4MQ.js";
+} from "./chunk-CGPKV4KH.js";
 import {
   ensureGatewayDiscovered
-} from "./chunk-2C4W3OMK.js";
+} from "./chunk-O4QDBQI6.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -177,18 +177,18 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-QGB3KDHH.js";
+} from "./chunk-JRDNNCM7.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-VONADK6G.js";
+} from "./chunk-METD44P2.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveRegistryRoot
-} from "./chunk-TH65DTOP.js";
+} from "./chunk-D6LZY3W7.js";
 import {
   resolveInsideRoot
 } from "./chunk-XEPZSDN5.js";
@@ -202,14 +202,14 @@ import {
   leastTrustedTier,
   memoryTrustTierTag,
   resolveContentTrustTier
-} from "./chunk-ENIRQJV6.js";
+} from "./chunk-BE6L6MIE.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-SX5DB6UR.js";
 import {
   createSessionMemory
-} from "./chunk-F27XFOVY.js";
+} from "./chunk-J2QYPARH.js";
 import {
   TrustTierSchema
 } from "./chunk-CJKHQ6MV.js";
@@ -233,10 +233,10 @@ import {
   terminateProcessTree,
   trackProcessTree,
   withTimeout
-} from "./chunk-KZIY5ZVF.js";
+} from "./chunk-WKNSD7YL.js";
 import {
   DEFAULTS
-} from "./chunk-NG2NUBBL.js";
+} from "./chunk-ZEDLXDDY.js";
 import {
   DEFAULT_EXECUTION_MODE,
   DEFAULT_TOOL_RATE_LIMITS,
@@ -248,28 +248,28 @@ import {
   parseGatewayExtraHeaders,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-M4XCGGKF.js";
+} from "./chunk-OM4JSIPB.js";
 import {
   resolveGatewayEnv
-} from "./chunk-J2K77DMF.js";
+} from "./chunk-DNXEQKBR.js";
 import {
   sanitizeErrorDetails
-} from "./chunk-37GZJOQE.js";
+} from "./chunk-22AF7TYV.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-7YJK2UR5.js";
+} from "./chunk-FE2VYSSA.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-KKVVD6KC.js";
+} from "./chunk-5O4KT2WO.js";
 import {
   AbortError,
   isTimeoutAbortReason,
   raceAbort,
   throwIfAborted
-} from "./chunk-2UEX46D3.js";
+} from "./chunk-ZTOTKIAO.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -390,7 +390,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -30391,7 +30391,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-ORVEWRFT.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-SONR6BIO.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -46561,7 +46561,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-B7EB4ZUV.js");
+    const { createIssueTriage } = await import("./issue-triage-CS4WXPIE.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num2 = issueMatch[2] ?? "";
@@ -46589,7 +46589,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-GXGC4UTR.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-R4AM2VPK.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -46963,7 +46963,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-D2FHUVUO.js");
+    const { executeVoting } = await import("./consensus-vote-OIQKDL5M.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47761,7 +47761,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-VTNOKICB.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-5DAEGAX5.js");
     const { getLearningDir } = await import("./learning-persistence-FB4U5AX2.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -47823,7 +47823,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-4J5WAAHZ.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-SFXZODKG.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -48010,7 +48010,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-D2FHUVUO.js");
+      const { executeVoting } = await import("./consensus-vote-OIQKDL5M.js");
       const votingResult = await executeVoting(
         {
           proposal: buildVoteProposal(plan, research),
@@ -48837,7 +48837,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-ZRHGDCZD.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-MVSIUA23.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -48855,7 +48855,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-VTNOKICB.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-5DAEGAX5.js");
     const { getLearningDir } = await import("./learning-persistence-FB4U5AX2.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -49447,7 +49447,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-4WBDTJ4W.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-CYO2YUAE.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -49518,7 +49518,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-J4VIB2CF.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-4KAW7ELW.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -53068,7 +53068,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-TLEAIKK4.js");
+    const { createScmProvider } = await import("./factory-G7SSRQET.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -54132,7 +54132,7 @@ async function probeSource(source, includeModelIds) {
 var GATEWAY_TRANSPORT = "gateway";
 var GATEWAY_API_ARM = "api:custom-openai";
 async function gatewaySource(apiArm) {
-  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-BBTGGIDV.js");
+  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-CUETEQEQ.js");
   const config = readOpenAICompatEnv();
   if (config !== null) {
     return {
@@ -54151,7 +54151,7 @@ async function gatewaySource(apiArm) {
 }
 async function defaultSources(includeOpenRouter, adaptersFactory) {
   const adapters = new Map(
-    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-F25AAIUW.js")).createAllAdapters()
+    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-KHLGIPPZ.js")).createAllAdapters()
   );
   const apiArm = adapters.get(GATEWAY_API_ARM);
   adapters.delete(GATEWAY_API_ARM);
@@ -57434,4 +57434,4 @@ export {
   startPipelineEventBridge,
   shutdownPipelineEventBridge
 };
-//# sourceMappingURL=chunk-B46ICMSM.js.map
+//# sourceMappingURL=chunk-33OFW2GU.js.map

package/dist/{chunk-Q7V4T5VC.js → chunk-4QWRKVJS.js}

@@ -4,7 +4,7 @@ import {
 import {
   assessReputation,
   sanitizeInput
-} from "./chunk-F65I2L2L.js";
+} from "./chunk-YLQNJAJP.js";
 import {
   allOf
 } from "./chunk-EZNIYU5T.js";
@@ -13,7 +13,7 @@ import {
   err,
   getTimeProvider,
   ok
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 
 // src/dogfooding/pr-reviewer-helpers.ts
 import { randomUUID } from "node:crypto";
@@ -477,4 +477,4 @@ export {
   createFailedReview,
   reviewPostingBlock
 };
-//# sourceMappingURL=chunk-Q7V4T5VC.js.map
+//# sourceMappingURL=chunk-4QWRKVJS.js.map

package/dist/{chunk-KKVVD6KC.js → chunk-5O4KT2WO.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "node:crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-KKVVD6KC.js.map
+//# sourceMappingURL=chunk-5O4KT2WO.js.map

package/dist/{chunk-GCWFVDAM.js → chunk-AG2XK7CQ.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-JEVYS4AL.js";
+} from "./chunk-SWHKENEB.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -21,7 +21,7 @@ import {
   hasMeasuredCategory,
   isDeclaredNeverDeprecate,
   isRegisteredToolName
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 import {
   getNexusDataDir,
   nexusDataPath
@@ -2293,4 +2293,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-GCWFVDAM.js.map
+//# sourceMappingURL=chunk-AG2XK7CQ.js.map

package/dist/{chunk-ENIRQJV6.js → chunk-BE6L6MIE.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-SX5DB6UR.js";
 import {
   SessionMemory
-} from "./chunk-F27XFOVY.js";
+} from "./chunk-J2QYPARH.js";
 import {
   TRUST_TIER_NUMERIC,
   TrustTierSchema
@@ -19,7 +19,7 @@ import {
 } from "./chunk-MUJCGBZW.js";
 import {
   generateId
-} from "./chunk-KKVVD6KC.js";
+} from "./chunk-5O4KT2WO.js";
 import {
   ErrorCode,
   NexusError,
@@ -33,7 +33,7 @@ import {
   ok,
   openSqliteDatabase,
   setSharedMobiMemDbPathResolver
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 import {
   nexusDataPath
 } from "./chunk-LWOX65CP.js";
@@ -5858,4 +5858,4 @@ export {
   shutdownToolMemory,
   ToolMemoryManager
 };
-//# sourceMappingURL=chunk-ENIRQJV6.js.map
+//# sourceMappingURL=chunk-BE6L6MIE.js.map

package/dist/{chunk-ZBF7CSLQ.js → chunk-BJJOZV7O.js}

@@ -7,16 +7,16 @@ import {
   readGatewayTransport,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-M4XCGGKF.js";
+} from "./chunk-OM4JSIPB.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
   redactGatewaySecrets
-} from "./chunk-J2K77DMF.js";
+} from "./chunk-DNXEQKBR.js";
 import {
   REDACTED_KEY_PLACEHOLDER,
   sanitizeErrorDetails
-} from "./chunk-37GZJOQE.js";
+} from "./chunk-22AF7TYV.js";
 import {
   CUSTOM_API_ALLOW_PRIVATE_ENV,
   ConfigError,
@@ -41,7 +41,7 @@ import {
   readModelAllowlist,
   recordUsageEvent,
   refineGatewayCatalog
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 
 // src/adapters/openai-compat-adapter.ts
 import OpenAI2 from "openai";
@@ -1048,4 +1048,4 @@ export {
   createOpenAICompatAdapter,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-ZBF7CSLQ.js.map
+//# sourceMappingURL=chunk-BJJOZV7O.js.map

package/dist/{chunk-OEUT34N5.js → chunk-C4OZ4F67.js}

@@ -4,13 +4,13 @@ import {
   createOpenAICompatAdapter,
   discoverGatewayCatalog,
   readOpenAICompatEnv
-} from "./chunk-ZBF7CSLQ.js";
+} from "./chunk-BJJOZV7O.js";
 import {
   gatewayProxyUrl
-} from "./chunk-M4XCGGKF.js";
+} from "./chunk-OM4JSIPB.js";
 import {
   redactGatewaySecrets
-} from "./chunk-J2K77DMF.js";
+} from "./chunk-DNXEQKBR.js";
 import {
   DEFAULT_OPENAI_COMPAT_ENDPOINT,
   GATEWAY_COST_ENV,
@@ -28,7 +28,7 @@ import {
   isCliDisabled,
   symbols,
   writeLine
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 
 // src/cli/doctor-gateway-slots.ts
 var FAMILY_SLOTS = [
@@ -371,4 +371,4 @@ export {
   formatGatewayReport,
   formatGatewaySlotWarnings
 };
-//# sourceMappingURL=chunk-OEUT34N5.js.map
+//# sourceMappingURL=chunk-C4OZ4F67.js.map

package/dist/{chunk-WWOKQDED.js → chunk-CDPPWCGO.js}

@@ -6,7 +6,7 @@ import {
   ValidationError,
   createLogger,
   formatZodError
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 
 // src/security/ast-rule-runner.ts
 import { existsSync } from "node:fs";
@@ -243,4 +243,4 @@ export {
   collectAstQaFindings,
   runAstQaRules
 };
-//# sourceMappingURL=chunk-WWOKQDED.js.map
+//# sourceMappingURL=chunk-CDPPWCGO.js.map

package/dist/{chunk-LBXRT4MQ.js → chunk-CGPKV4KH.js}

@@ -1,15 +1,15 @@
 import {
   ensureGatewayDiscovered,
   gatewayDiscoveryGeneration
-} from "./chunk-2C4W3OMK.js";
+} from "./chunk-O4QDBQI6.js";
 import {
   createAutoAdapter
-} from "./chunk-KZIY5ZVF.js";
+} from "./chunk-WKNSD7YL.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   isCallerCancelled,
   mapModelErrorToCategory
-} from "./chunk-2UEX46D3.js";
+} from "./chunk-ZTOTKIAO.js";
 import {
   CircularBuffer,
   ConfigError,
@@ -34,7 +34,7 @@ import {
   resolveModelIdentitySync,
   toRateLimitError,
   warnIfGatewayCostUndeclared
-} from "./chunk-XKRHWU5P.js";
+} from "./chunk-RIF7TUYH.js";
 
 // src/config/model-equivalence.ts
 var VARIANT_QUIRKS = /* @__PURE__ */ new Set(["small", "image"]);
@@ -1076,4 +1076,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-LBXRT4MQ.js.map
+//# sourceMappingURL=chunk-CGPKV4KH.js.map