nexus-agents 8.55.7 → 8.56.0

package/dist/{chunk-FNL43KEP.js → chunk-5W55WXLY.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-WJRD5RYE.js";
+} from "./chunk-BWP3RTR2.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2278,4 +2278,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-FNL43KEP.js.map
+//# sourceMappingURL=chunk-5W55WXLY.js.map

package/dist/{chunk-WJRD5RYE.js → chunk-BWP3RTR2.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-YJPKZHKU.js";
+} from "./chunk-UURJGJTW.js";
 import {
   emitClawGuardViolation
 } from "./chunk-VZSMNIRN.js";
@@ -1100,16 +1100,19 @@ function emitToolAudit({
     ...nearMiss ? { policyDecision: "would_deny" } : {}
   });
 }
-function hashRawFields(fields, args) {
-  if (fields === void 0) return {};
-  if (typeof args !== "object" || args === null) return {};
+function measureRawFields(fields, args) {
+  if (fields === void 0) return { rawFieldHashes: {}, rawFieldBytes: {} };
+  if (typeof args !== "object" || args === null) return { rawFieldHashes: {}, rawFieldBytes: {} };
   const source = args;
-  const out = {};
+  const rawFieldHashes = {};
+  const rawFieldBytes = {};
   for (const [field, hash] of Object.entries(fields)) {
     const value = source[field];
-    if (typeof value === "string") out[field] = hash(value);
+    if (typeof value !== "string") continue;
+    rawFieldHashes[field] = hash(value);
+    rawFieldBytes[field] = Buffer.byteLength(value, "utf-8");
   }
-  return out;
+  return { rawFieldHashes, rawFieldBytes };
 }
 function unsanitizedContext(config, args) {
   return {
@@ -1117,7 +1120,7 @@ function unsanitizedContext(config, args) {
     commentsRemoved: 0,
     fieldsModified: 0,
     tagsRemoved: 0,
-    rawFieldHashes: hashRawFields(config.rawHashFields, args)
+    ...measureRawFields(config.rawHashFields, args)
   };
 }
 function runPreChecks(config, args, mode, requestContext, logger) {
@@ -1138,8 +1141,9 @@ function runPreChecks(config, args, mode, requestContext, logger) {
     commentsRemoved: sanitizeResult.commentsRemoved,
     fieldsModified: sanitizeResult.modifiedCount,
     tagsRemoved: sanitizeResult.tagsRemoved,
-    // #5385: hashed from `args`, the RAW input, before sanitization touched it.
-    rawFieldHashes: hashRawFields(config.rawHashFields, args)
+    // #5385/#6177: hashed and measured from `args`, the RAW input, before
+    // sanitization touched it.
+    ...measureRawFields(config.rawHashFields, args)
   };
   const refusal = checkSecurityTier(config.securityTier ?? "standard", sanitizeResult, logger);
   if (refusal !== null) {
@@ -2374,4 +2378,4 @@ export {
   DEFAULT_CONSENSUS_CONFIG,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-WJRD5RYE.js.map
+//# sourceMappingURL=chunk-BWP3RTR2.js.map