nestor-sh 3.5.1 → 3.5.2

package/dist/nestor.mjs

@@ -14967,7 +14967,7 @@ function isNativeAvailable() {
   return nativeModule !== null;
 }
 function getNativeVersion() {
-  return nativeModule ? "3.5.1" : null;
+  return nativeModule ? "3.5.2" : null;
 }
 function validateSsrf(url, allowPrivate = false) {
   if (nativeModule) {
@@ -15872,7 +15872,12 @@ var init_docker = __esm({
         this.timeoutMs = options.timeoutMs ?? 3e4;
         this.memoryLimit = options.memoryLimit ?? `${config2.memoryLimitMb}m`;
         this.cpuLimit = options.cpuLimit ?? config2.cpuLimitPercent / 100;
-        this.networkEnabled = config2.networkPolicy !== "none";
+        this.networkEnabled = config2.networkPolicy === "restricted" || config2.networkPolicy === "full";
+        if (config2.networkPolicy === void 0) {
+          console.warn(
+            '[nestor:sandbox] networkPolicy not set \u2014 defaulting to DISABLED for security. Set networkPolicy: "restricted" or "full" explicitly to allow network access.'
+          );
+        }
         this.workDir = options.workDir ?? "/workspace";
       }
       /**
@@ -119716,7 +119721,7 @@ var SERVER_VERSION, startTime;
 var init_health = __esm({
   "../server/src/routes/health.ts"() {
     "use strict";
-    SERVER_VERSION = "3.5.1";
+    SERVER_VERSION = "3.5.2";
     startTime = Date.now();
   }
 });
@@ -121129,7 +121134,7 @@ var init_system = __esm({
     init_error_handler();
     init_broadcaster();
     init_approval_service();
-    SERVER_VERSION2 = "3.5.1";
+    SERVER_VERSION2 = "3.5.2";
     startTime2 = Date.now();
     UpdateConfigSchema = z20.object({
       server: z20.object({
@@ -158907,7 +158912,7 @@ var init_admin3 = __esm({
   "../server/src/routes/admin.ts"() {
     "use strict";
     init_rate_limit();
-    SERVER_VERSION3 = "3.5.1";
+    SERVER_VERSION3 = "3.5.2";
     startTime3 = Date.now();
   }
 });
@@ -162484,7 +162489,7 @@ var VERSION2, DATA_DIR3, TELEMETRY_ID_FILE, TELEMETRY_LOG_FILE, DEFAULT_FLUSH_TH
 var init_telemetry2 = __esm({
   "../server/src/services/telemetry.ts"() {
     "use strict";
-    VERSION2 = "3.5.1";
+    VERSION2 = "3.5.2";
     DATA_DIR3 = join27(homedir10(), ".nestor");
     TELEMETRY_ID_FILE = join27(DATA_DIR3, "telemetry-id");
     TELEMETRY_LOG_FILE = join27(DATA_DIR3, "telemetry.jsonl");
@@ -289658,438 +289663,14 @@ var require_chat_stream = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/ms@2.0.0/node_modules/ms/index.js
-var require_ms2 = __commonJS({
-  "../../node_modules/.pnpm/ms@2.0.0/node_modules/ms/index.js"(exports2, module2) {
-    var s = 1e3;
-    var m = s * 60;
-    var h = m * 60;
-    var d = h * 24;
-    var y = d * 365.25;
-    module2.exports = function(val, options) {
-      options = options || {};
-      var type = typeof val;
-      if (type === "string" && val.length > 0) {
-        return parse(val);
-      } else if (type === "number" && isNaN(val) === false) {
-        return options.long ? fmtLong(val) : fmtShort(val);
-      }
-      throw new Error(
-        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
-      );
-    };
-    function parse(str) {
-      str = String(str);
-      if (str.length > 100) {
-        return;
-      }
-      var match = /^((?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|years?|yrs?|y)?$/i.exec(
-        str
-      );
-      if (!match) {
-        return;
-      }
-      var n = parseFloat(match[1]);
-      var type = (match[2] || "ms").toLowerCase();
-      switch (type) {
-        case "years":
-        case "year":
-        case "yrs":
-        case "yr":
-        case "y":
-          return n * y;
-        case "days":
-        case "day":
-        case "d":
-          return n * d;
-        case "hours":
-        case "hour":
-        case "hrs":
-        case "hr":
-        case "h":
-          return n * h;
-        case "minutes":
-        case "minute":
-        case "mins":
-        case "min":
-        case "m":
-          return n * m;
-        case "seconds":
-        case "second":
-        case "secs":
-        case "sec":
-        case "s":
-          return n * s;
-        case "milliseconds":
-        case "millisecond":
-        case "msecs":
-        case "msec":
-        case "ms":
-          return n;
-        default:
-          return void 0;
-      }
-    }
-    function fmtShort(ms) {
-      if (ms >= d) {
-        return Math.round(ms / d) + "d";
-      }
-      if (ms >= h) {
-        return Math.round(ms / h) + "h";
-      }
-      if (ms >= m) {
-        return Math.round(ms / m) + "m";
-      }
-      if (ms >= s) {
-        return Math.round(ms / s) + "s";
-      }
-      return ms + "ms";
-    }
-    function fmtLong(ms) {
-      return plural(ms, d, "day") || plural(ms, h, "hour") || plural(ms, m, "minute") || plural(ms, s, "second") || ms + " ms";
-    }
-    function plural(ms, n, name) {
-      if (ms < n) {
-        return;
-      }
-      if (ms < n * 1.5) {
-        return Math.floor(ms / n) + " " + name;
-      }
-      return Math.ceil(ms / n) + " " + name + "s";
-    }
-  }
-});
-
-// ../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/debug.js
-var require_debug3 = __commonJS({
-  "../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/debug.js"(exports2, module2) {
-    exports2 = module2.exports = createDebug.debug = createDebug["default"] = createDebug;
-    exports2.coerce = coerce;
-    exports2.disable = disable;
-    exports2.enable = enable;
-    exports2.enabled = enabled;
-    exports2.humanize = require_ms2();
-    exports2.names = [];
-    exports2.skips = [];
-    exports2.formatters = {};
-    var prevTime;
-    function selectColor(namespace) {
-      var hash = 0, i;
-      for (i in namespace) {
-        hash = (hash << 5) - hash + namespace.charCodeAt(i);
-        hash |= 0;
-      }
-      return exports2.colors[Math.abs(hash) % exports2.colors.length];
-    }
-    function createDebug(namespace) {
-      function debug5() {
-        if (!debug5.enabled) return;
-        var self2 = debug5;
-        var curr = +/* @__PURE__ */ new Date();
-        var ms = curr - (prevTime || curr);
-        self2.diff = ms;
-        self2.prev = prevTime;
-        self2.curr = curr;
-        prevTime = curr;
-        var args = new Array(arguments.length);
-        for (var i = 0; i < args.length; i++) {
-          args[i] = arguments[i];
-        }
-        args[0] = exports2.coerce(args[0]);
-        if ("string" !== typeof args[0]) {
-          args.unshift("%O");
-        }
-        var index = 0;
-        args[0] = args[0].replace(/%([a-zA-Z%])/g, function(match, format3) {
-          if (match === "%%") return match;
-          index++;
-          var formatter = exports2.formatters[format3];
-          if ("function" === typeof formatter) {
-            var val = args[index];
-            match = formatter.call(self2, val);
-            args.splice(index, 1);
-            index--;
-          }
-          return match;
-        });
-        exports2.formatArgs.call(self2, args);
-        var logFn = debug5.log || exports2.log || console.log.bind(console);
-        logFn.apply(self2, args);
-      }
-      debug5.namespace = namespace;
-      debug5.enabled = exports2.enabled(namespace);
-      debug5.useColors = exports2.useColors();
-      debug5.color = selectColor(namespace);
-      if ("function" === typeof exports2.init) {
-        exports2.init(debug5);
-      }
-      return debug5;
-    }
-    function enable(namespaces) {
-      exports2.save(namespaces);
-      exports2.names = [];
-      exports2.skips = [];
-      var split = (typeof namespaces === "string" ? namespaces : "").split(/[\s,]+/);
-      var len = split.length;
-      for (var i = 0; i < len; i++) {
-        if (!split[i]) continue;
-        namespaces = split[i].replace(/\*/g, ".*?");
-        if (namespaces[0] === "-") {
-          exports2.skips.push(new RegExp("^" + namespaces.substr(1) + "$"));
-        } else {
-          exports2.names.push(new RegExp("^" + namespaces + "$"));
-        }
-      }
-    }
-    function disable() {
-      exports2.enable("");
-    }
-    function enabled(name) {
-      var i, len;
-      for (i = 0, len = exports2.skips.length; i < len; i++) {
-        if (exports2.skips[i].test(name)) {
-          return false;
-        }
-      }
-      for (i = 0, len = exports2.names.length; i < len; i++) {
-        if (exports2.names[i].test(name)) {
-          return true;
-        }
-      }
-      return false;
-    }
-    function coerce(val) {
-      if (val instanceof Error) return val.stack || val.message;
-      return val;
-    }
-  }
-});
-
-// ../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/browser.js
-var require_browser4 = __commonJS({
-  "../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/browser.js"(exports2, module2) {
-    exports2 = module2.exports = require_debug3();
-    exports2.log = log3;
-    exports2.formatArgs = formatArgs;
-    exports2.save = save;
-    exports2.load = load;
-    exports2.useColors = useColors;
-    exports2.storage = "undefined" != typeof chrome && "undefined" != typeof chrome.storage ? chrome.storage.local : localstorage();
-    exports2.colors = [
-      "lightseagreen",
-      "forestgreen",
-      "goldenrod",
-      "dodgerblue",
-      "darkorchid",
-      "crimson"
-    ];
-    function useColors() {
-      if (typeof window !== "undefined" && window.process && window.process.type === "renderer") {
-        return true;
-      }
-      return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // is firebug? http://stackoverflow.com/a/398120/376773
-      typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // is firefox >= v31?
-      // https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
-      typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/) && parseInt(RegExp.$1, 10) >= 31 || // double check webkit in userAgent just in case we are in a worker
-      typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/);
-    }
-    exports2.formatters.j = function(v) {
-      try {
-        return JSON.stringify(v);
-      } catch (err) {
-        return "[UnexpectedJSONParseError]: " + err.message;
-      }
-    };
-    function formatArgs(args) {
-      var useColors2 = this.useColors;
-      args[0] = (useColors2 ? "%c" : "") + this.namespace + (useColors2 ? " %c" : " ") + args[0] + (useColors2 ? "%c " : " ") + "+" + exports2.humanize(this.diff);
-      if (!useColors2) return;
-      var c = "color: " + this.color;
-      args.splice(1, 0, c, "color: inherit");
-      var index = 0;
-      var lastC = 0;
-      args[0].replace(/%[a-zA-Z%]/g, function(match) {
-        if ("%%" === match) return;
-        index++;
-        if ("%c" === match) {
-          lastC = index;
-        }
-      });
-      args.splice(lastC, 0, c);
-    }
-    function log3() {
-      return "object" === typeof console && console.log && Function.prototype.apply.call(console.log, console, arguments);
-    }
-    function save(namespaces) {
-      try {
-        if (null == namespaces) {
-          exports2.storage.removeItem("debug");
-        } else {
-          exports2.storage.debug = namespaces;
-        }
-      } catch (e) {
-      }
-    }
-    function load() {
-      var r;
-      try {
-        r = exports2.storage.debug;
-      } catch (e) {
-      }
-      if (!r && typeof process !== "undefined" && "env" in process) {
-        r = process.env.DEBUG;
-      }
-      return r;
-    }
-    exports2.enable(load());
-    function localstorage() {
-      try {
-        return window.localStorage;
-      } catch (e) {
-      }
-    }
-  }
-});
-
-// ../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/node.js
-var require_node15 = __commonJS({
-  "../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/node.js"(exports2, module2) {
-    var tty = __require("tty");
-    var util = __require("util");
-    exports2 = module2.exports = require_debug3();
-    exports2.init = init;
-    exports2.log = log3;
-    exports2.formatArgs = formatArgs;
-    exports2.save = save;
-    exports2.load = load;
-    exports2.useColors = useColors;
-    exports2.colors = [6, 2, 3, 4, 5, 1];
-    exports2.inspectOpts = Object.keys(process.env).filter(function(key) {
-      return /^debug_/i.test(key);
-    }).reduce(function(obj2, key) {
-      var prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, function(_, k) {
-        return k.toUpperCase();
-      });
-      var val = process.env[key];
-      if (/^(yes|on|true|enabled)$/i.test(val)) val = true;
-      else if (/^(no|off|false|disabled)$/i.test(val)) val = false;
-      else if (val === "null") val = null;
-      else val = Number(val);
-      obj2[prop] = val;
-      return obj2;
-    }, {});
-    var fd = parseInt(process.env.DEBUG_FD, 10) || 2;
-    if (1 !== fd && 2 !== fd) {
-      util.deprecate(function() {
-      }, "except for stderr(2) and stdout(1), any other usage of DEBUG_FD is deprecated. Override debug.log if you want to use a different log function (https://git.io/debug_fd)")();
-    }
-    var stream = 1 === fd ? process.stdout : 2 === fd ? process.stderr : createWritableStdioStream(fd);
-    function useColors() {
-      return "colors" in exports2.inspectOpts ? Boolean(exports2.inspectOpts.colors) : tty.isatty(fd);
-    }
-    exports2.formatters.o = function(v) {
-      this.inspectOpts.colors = this.useColors;
-      return util.inspect(v, this.inspectOpts).split("\n").map(function(str) {
-        return str.trim();
-      }).join(" ");
-    };
-    exports2.formatters.O = function(v) {
-      this.inspectOpts.colors = this.useColors;
-      return util.inspect(v, this.inspectOpts);
-    };
-    function formatArgs(args) {
-      var name = this.namespace;
-      var useColors2 = this.useColors;
-      if (useColors2) {
-        var c = this.color;
-        var prefix = "  \x1B[3" + c + ";1m" + name + " \x1B[0m";
-        args[0] = prefix + args[0].split("\n").join("\n" + prefix);
-        args.push("\x1B[3" + c + "m+" + exports2.humanize(this.diff) + "\x1B[0m");
-      } else {
-        args[0] = (/* @__PURE__ */ new Date()).toUTCString() + " " + name + " " + args[0];
-      }
-    }
-    function log3() {
-      return stream.write(util.format.apply(util, arguments) + "\n");
-    }
-    function save(namespaces) {
-      if (null == namespaces) {
-        delete process.env.DEBUG;
-      } else {
-        process.env.DEBUG = namespaces;
-      }
-    }
-    function load() {
-      return process.env.DEBUG;
-    }
-    function createWritableStdioStream(fd2) {
-      var stream2;
-      var tty_wrap = process.binding("tty_wrap");
-      switch (tty_wrap.guessHandleType(fd2)) {
-        case "TTY":
-          stream2 = new tty.WriteStream(fd2);
-          stream2._type = "tty";
-          if (stream2._handle && stream2._handle.unref) {
-            stream2._handle.unref();
-          }
-          break;
-        case "FILE":
-          var fs32 = __require("fs");
-          stream2 = new fs32.SyncWriteStream(fd2, { autoClose: false });
-          stream2._type = "fs";
-          break;
-        case "PIPE":
-        case "TCP":
-          var net = __require("net");
-          stream2 = new net.Socket({
-            fd: fd2,
-            readable: false,
-            writable: true
-          });
-          stream2.readable = false;
-          stream2.read = null;
-          stream2._type = "pipe";
-          if (stream2._handle && stream2._handle.unref) {
-            stream2._handle.unref();
-          }
-          break;
-        default:
-          throw new Error("Implement me. Unknown stream file type!");
-      }
-      stream2.fd = fd2;
-      stream2._isStdio = true;
-      return stream2;
-    }
-    function init(debug5) {
-      debug5.inspectOpts = {};
-      var keys = Object.keys(exports2.inspectOpts);
-      for (var i = 0; i < keys.length; i++) {
-        debug5.inspectOpts[keys[i]] = exports2.inspectOpts[keys[i]];
-      }
-    }
-    exports2.enable(load());
-  }
-});
-
-// ../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/index.js
-var require_src19 = __commonJS({
-  "../../node_modules/.pnpm/debug@2.6.9/node_modules/debug/src/index.js"(exports2, module2) {
-    if (typeof process !== "undefined" && process.type === "renderer") {
-      module2.exports = require_browser4();
-    } else {
-      module2.exports = require_node15();
-    }
-  }
-});
-
 // ../../node_modules/.pnpm/follow-redirects@1.15.11/node_modules/follow-redirects/debug.js
-var require_debug4 = __commonJS({
+var require_debug3 = __commonJS({
   "../../node_modules/.pnpm/follow-redirects@1.15.11/node_modules/follow-redirects/debug.js"(exports2, module2) {
     var debug5;
     module2.exports = function() {
       if (!debug5) {
         try {
-          debug5 = require_src19()("follow-redirects");
+          debug5 = require_src()("follow-redirects");
         } catch (error) {
         }
         if (typeof debug5 !== "function") {
@@ -290111,7 +289692,7 @@ var require_follow_redirects = __commonJS({
     var https2 = __require("https");
     var Writable = __require("stream").Writable;
     var assert3 = __require("assert");
-    var debug5 = require_debug4();
+    var debug5 = require_debug3();
     (function detectUnsupportedEnvironment() {
       var looksLikeNode = typeof process !== "undefined";
       var looksLikeBrowser = typeof window !== "undefined" && typeof document !== "undefined";
@@ -308173,7 +307754,7 @@ var require_SocketModeClient = __commonJS({
 });
 
 // ../../node_modules/.pnpm/@slack+socket-mode@2.0.6/node_modules/@slack/socket-mode/dist/src/index.js
-var require_src20 = __commonJS({
+var require_src19 = __commonJS({
   "../../node_modules/.pnpm/@slack+socket-mode@2.0.6/node_modules/@slack/socket-mode/dist/src/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -308259,7 +307840,7 @@ var require_SocketModeReceiver = __commonJS({
     var node_url_1 = __require("node:url");
     var logger_1 = require_dist21();
     var oauth_1 = require_dist25();
-    var socket_mode_1 = require_src20();
+    var socket_mode_1 = require_src19();
     var path_to_regexp_1 = require_dist26();
     var SocketModeFunctions_1 = require_SocketModeFunctions();
     var SocketModeResponseAck_1 = require_SocketModeResponseAck();
@@ -311707,7 +311288,7 @@ var init_src8 = __esm({
         await this._handle.listen();
         const authMode = config2.apiKey ? "API key" : "open (no auth)";
         console.log(`
-  Nestor Server v3.5.1`);
+  Nestor Server v3.5.2`);
         console.log(`  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
         console.log(`  HTTP    : http://${this._host}:${this._port}`);
         console.log(`  WS      : ws://${this._host}:${this._port}/ws`);
@@ -321496,7 +321077,7 @@ var init_server = __esm({
     MCP_PROTOCOL_VERSION = "2024-11-05";
     SERVER_INFO = {
       name: "nestor",
-      version: "3.5.1"
+      version: "3.5.2"
     };
     SERVER_CAPABILITIES = {
       tools: { listChanged: false },
@@ -322217,7 +321798,7 @@ function printWelcome() {
   console.log(chalk15.cyan(` | .\` | | _|  \\__ \\   | |   | (_) | |   /  _  \\__ \\ | __ |`));
   console.log(chalk15.cyan(` |_|\\_| |___| |___/   |_|    \\___/  |_|_\\ (_) |___/ |_||_|`));
   console.log("");
-  console.log(chalk15.dim("  Interactive Shell \u2014 v3.5.1"));
+  console.log(chalk15.dim("  Interactive Shell \u2014 v3.5.2"));
   console.log(chalk15.dim("  Type /help for commands, /exit to quit."));
   console.log(chalk15.dim("  Multiline: end a line with \\ or use ``` code blocks."));
   console.log("");
@@ -324136,7 +323717,7 @@ var BANNER = `
 function registerStartCommand(program2) {
   program2.command("start").description("Start the Nestor server").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--no-studio", "Disable the Studio web UI").action(async (options) => {
     console.log(chalk.cyan(BANNER));
-    console.log(chalk.dim(`  v3.5.1
+    console.log(chalk.dim(`  v3.5.2
 `));
     let config2 = readConfigFile();
     if (!config2) {
@@ -326195,7 +325776,7 @@ async function startForeground() {
   console.log(chalk23.cyan(` | .\` | | _|  \\__ \\   | |   | (_) | |   /  _  \\__ \\ | __ |`));
   console.log(chalk23.cyan(` |_|\\_| |___| |___/   |_|    \\___/  |_|_\\ (_) |___/ |_||_|`));
   console.log("");
-  console.log(chalk23.dim("  Daemon Mode \u2014 v3.5.1"));
+  console.log(chalk23.dim("  Daemon Mode \u2014 v3.5.2"));
   console.log(chalk23.dim(`  PID: ${process.pid}`));
   console.log(chalk23.dim(`  Log: ${LOG_FILE}`));
   console.log("");
@@ -329704,7 +329285,7 @@ function registerEvolveCommand(program2) {
 
 // src/index.ts
 var program = new Command();
-program.name("nestor-sh").description("Nestor AI Agent Platform \u2014 orchestrate, secure and monitor AI agents").version("3.5.1");
+program.name("nestor-sh").description("Nestor AI Agent Platform \u2014 orchestrate, secure and monitor AI agents").version("3.5.2");
 registerStartCommand(program);
 registerInstallCommand(program);
 registerAgentCommand(program);