nexus-agents 8.82.2 → 8.83.0

package/dist/{chunk-RRTISAC5.js → chunk-CPJWPHUX.js}

@@ -1,6 +1,9 @@
 import {
   VERSION
-} from "./chunk-2TR3B7MN.js";
+} from "./chunk-NXMETLX7.js";
+import {
+  sanitizeErrorDetails
+} from "./chunk-2NDA4DHW.js";
 import {
   DEFAULT_EXECUTION_MODE
 } from "./chunk-ECJ52NSK.js";
@@ -20,7 +23,7 @@ import {
   getTimeProvider,
   ok,
   resolveToolClassGuardMs
-} from "./chunk-SV2TOCSR.js";
+} from "./chunk-IPZC5BXM.js";
 import {
   getNexusDataDir,
   parseBoolValue
@@ -1236,36 +1239,42 @@ function internalError(message, requestId) {
   });
 }
 var MAX_INPUT_SIZE_BYTES = 10 * 1024 * 1024;
-var SECRET_PATTERNS = [
-  // API keys with common prefixes
-  /\b(sk-[a-zA-Z0-9]{20,})\b/g,
-  /\b(pk-[a-zA-Z0-9]{20,})\b/g,
-  // AWS-style keys
-  /\b(AKIA[A-Z0-9]{16})\b/g,
-  // Bearer tokens in output
-  /Bearer\s+[a-zA-Z0-9_\-.~+/]+=*/g,
-  // Generic long hex secrets (40+ chars)
-  /\b[0-9a-f]{40,}\b/gi,
-  // password= or token= in output
-  /(?:password|token|secret|apikey|api_key)\s*[=:]\s*\S{8,}/gi
-];
 function sanitizeOutput(text, logger) {
-  let sanitized = text;
-  for (const pattern of SECRET_PATTERNS) {
-    const before = sanitized;
-    sanitized = sanitized.replace(pattern, "[REDACTED]");
-    if (sanitized !== before) {
-      logger.warn("Potential secret detected in tool output, redacting", {
-        pattern: pattern.source.slice(0, 30)
-      });
-    }
+  const sanitized = sanitizeErrorDetails(text, void 0, "[REDACTED]");
+  if (sanitized !== text && logger !== void 0) {
+    logger.warn("Potential secret detected in tool output, redacting");
   }
   return sanitized;
 }
+function sanitizeDeep(value, logger) {
+  if (typeof value === "string") {
+    return sanitizeOutput(value, logger);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeDeep(item, logger));
+  }
+  if (typeof value === "object" && value !== null) {
+    return sanitizeDeepRecord(value, logger);
+  }
+  return value;
+}
+function sanitizeDeepRecord(obj, logger) {
+  const result = {};
+  for (const [key, val] of Object.entries(obj)) {
+    result[key] = sanitizeDeep(val, logger);
+  }
+  return result;
+}
 function sanitizeToolResult(result, logger) {
   for (const item of result.content) {
     item.text = sanitizeOutput(item.text, logger);
   }
+  if (result.structuredContent !== void 0) {
+    result.structuredContent = sanitizeDeepRecord(result.structuredContent, logger);
+  }
+  if (result._meta !== void 0) {
+    result._meta = sanitizeDeepRecord(result._meta, logger);
+  }
 }
 function checkInputSize(args, logger, requestId) {
   if (args === void 0) return null;
@@ -2289,6 +2298,7 @@ export {
   logToolInvocationAudit,
   logPolicyAudit,
   logRateLimitAudit,
+  ERROR_ENVELOPE_META_KEY,
   defaultRetryable,
   coarsenFailureCategory,
   toolSuccess,
@@ -2332,4 +2342,4 @@ export {
   DEFAULT_CONSENSUS_CONFIG,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-RRTISAC5.js.map
+//# sourceMappingURL=chunk-CPJWPHUX.js.map