nexus-agents 2.71.0 → 2.72.1

package/dist/{chunk-U6BK5DQU.js → chunk-YOREAPF6.js}

@@ -1,16 +1,17 @@
 import {
   DEFAULTS
-} from "./chunk-L2LQ3TSV.js";
+} from "./chunk-2MD5MWCK.js";
 import {
   resolveInsideRoot
 } from "./chunk-NUBSJGQZ.js";
 import {
   createAllAdapters
-} from "./chunk-XATH462F.js";
+} from "./chunk-ES6GFP35.js";
 import {
   capitalize
 } from "./chunk-633WH2ML.js";
 import {
+  CLI_SUBPROCESS_TIMEOUTS,
   CliNameSchema,
   DEFAULT_CAPABILITIES,
   DEFAULT_COMPOSITE_CONFIG,
@@ -26,19 +27,20 @@ import {
   ok,
   symbols,
   writeLine
-} from "./chunk-7OBFO4GF.js";
+} from "./chunk-O4KUCF5S.js";
 import {
   getLearningDir,
   getOutcomesFile,
   getRulesFile,
   isPersistenceEnabled
-} from "./chunk-LJT65EA7.js";
+} from "./chunk-I7ORMAO7.js";
 import {
+  detectSandbox,
   getNexusDataDir
-} from "./chunk-FDNWRZNJ.js";
+} from "./chunk-GOT7OAL5.js";
 
 // src/version.ts
-var VERSION = true ? "2.71.0" : "dev";
+var VERSION = true ? "2.72.1" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -1295,12 +1297,18 @@ function getConfig(options) {
 }
 
 // src/cli/setup-data-dir.ts
-import { mkdirSync, existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
+import { mkdirSync, existsSync as existsSync4 } from "fs";
+import { join as join4 } from "path";
 
 // src/cli/doctor.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, accessSync, constants as fsConstants } from "fs";
-import { join as join2 } from "path";
+import {
+  existsSync as existsSync3,
+  readFileSync as readFileSync3,
+  readdirSync,
+  accessSync,
+  constants as fsConstants
+} from "fs";
+import { join as join3 } from "path";
 
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -1600,7 +1608,12 @@ function printRegistryAdvisory(advisory) {
     writeLine(
       `${colors.yellow}${symbols.warn}${colors.reset} Model registry is ${ageText} \u2014 may have stale model data`
     );
-    writeLine(`  ${colors.dim}Run: npx tsx scripts/probe-models.ts${colors.reset}`);
+    writeLine(
+      `  ${colors.dim}Update with 'npm update -g nexus-agents' to pick up the latest registry,${colors.reset}`
+    );
+    writeLine(
+      `  ${colors.dim}or run 'nexus-agents registry refresh' to probe currently-installed models.${colors.reset}`
+    );
   } else {
     writeLine(`${formatStatus(true)} Model registry: ${ageText}`);
   }
@@ -1670,6 +1683,42 @@ function printDataDirectory(check) {
     writeLine(`  ${colors.dim}Run: nexus-agents setup${colors.reset}`);
   }
 }
+function printSandboxHeader(check) {
+  if (check.active) {
+    writeLine(`${formatStatus(true)} Sandbox flavor: ${check.flavor ?? "(unknown)"}`);
+    writeLine(`  ${colors.dim}NEXUS_SANDBOX_ROOT: ${check.root ?? "(unset)"}${colors.reset}`);
+    return;
+  }
+  writeLine(
+    `${formatStatus(false, true)} Container detected (${check.heuristicMatch ?? "unknown"}) but ${colors.yellow}NEXUS_SANDBOX is unset${colors.reset}`
+  );
+  writeLine(
+    `  ${colors.dim}Set NEXUS_SANDBOX=<flavor> in the image to opt into sandbox-aware behaviour.${colors.reset}`
+  );
+}
+function printSandboxWarnings(check) {
+  if (check.mismatch && check.active) {
+    writeLine(
+      `  ${colors.yellow}Mismatch: NEXUS_SANDBOX is set but no container heuristic matched (heuristic=${String(check.heuristicMatch)}).${colors.reset}`
+    );
+  }
+  if (check.dataDirInsideRepo) {
+    writeLine(
+      `  ${colors.yellow}NEXUS_DATA_DIR resolves inside a single repo subfolder of NEXUS_SANDBOX_ROOT \u2014 state will be lost when switching repos. Set NEXUS_DATA_DIR at the multi-repo root.${colors.reset}`
+    );
+  }
+}
+function printSandbox(check) {
+  const heuristicSaysContainer = check.heuristicMatch === "docker" || check.heuristicMatch === "podman";
+  if (!check.active && !heuristicSaysContainer) {
+    return;
+  }
+  writeLine(`${colors.cyan}Checking sandbox awareness...${colors.reset}`);
+  writeLine("");
+  printSandboxHeader(check);
+  printSandboxWarnings(check);
+  writeLine("");
+}
 function printDoctorSummary(result) {
   const unhealthyCount = result.clis.filter((c) => !c.installed || !c.authenticated).length;
   const nodeIssue = result.nodeVersion.supported ? 0 : 1;
@@ -1720,9 +1769,197 @@ function printDoctorResults(result) {
   printSqliteCheck(result.sqliteCheck);
   printDataDirectory(result.dataDirectory);
   writeLine("");
+  printSandbox(result.sandbox);
   printDoctorSummary(result);
 }
 
+// src/cli/cli-auth-probe.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+var execFileAsync = promisify(execFile);
+var HOME = homedir();
+function claudeNeedsLogin(reason) {
+  return {
+    cli: "claude",
+    state: "needs-login",
+    reason,
+    fixCommand: "claude /login",
+    envFallback: "ANTHROPIC_API_KEY",
+    fixUrl: "https://console.anthropic.com/account/keys"
+  };
+}
+function probeClaude() {
+  if (process.env["ANTHROPIC_API_KEY"] !== void 0 && process.env["ANTHROPIC_API_KEY"] !== "") {
+    return { cli: "claude", state: "authenticated", via: "env-var" };
+  }
+  const credPath = join2(HOME, ".claude", ".credentials.json");
+  if (!existsSync2(credPath)) {
+    return claudeNeedsLogin(
+      "No credentials at ~/.claude/.credentials.json and ANTHROPIC_API_KEY is not set"
+    );
+  }
+  try {
+    const parsed = JSON.parse(readFileSync2(credPath, "utf-8"));
+    if (!isClaudeCredsShape(parsed)) {
+      return claudeNeedsLogin(
+        "Credentials file present but not in expected shape (missing claudeAiOauth.accessToken)"
+      );
+    }
+    const expiresAt = parsed.claudeAiOauth.expiresAt;
+    if (typeof expiresAt === "number" && expiresAt < Date.now()) {
+      return claudeNeedsLogin(`OAuth token expired ${new Date(expiresAt).toISOString()}`);
+    }
+    return {
+      cli: "claude",
+      state: "authenticated",
+      via: "cli-credentials",
+      ...typeof expiresAt === "number" ? { meta: { expiresAt } } : {}
+    };
+  } catch (e) {
+    return {
+      cli: "claude",
+      state: "error",
+      reason: `Failed to read claude credentials: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
+function codexNeedsLogin(reason) {
+  return {
+    cli: "codex",
+    state: "needs-login",
+    reason,
+    fixCommand: "codex login",
+    envFallback: "OPENAI_API_KEY",
+    fixUrl: "https://platform.openai.com/api-keys"
+  };
+}
+function classifyCodexStdout(stdout) {
+  if (/not logged/i.test(stdout) || /no.*token/i.test(stdout)) {
+    return codexNeedsLogin(stdout.trim().split("\n")[0] ?? "Not logged in");
+  }
+  return { cli: "codex", state: "authenticated", via: "cli-credentials" };
+}
+async function probeCodex() {
+  if (process.env["OPENAI_API_KEY"] !== void 0 && process.env["OPENAI_API_KEY"] !== "") {
+    return { cli: "codex", state: "authenticated", via: "env-var" };
+  }
+  try {
+    const { stdout } = await execFileAsync("codex", ["login", "status"], {
+      timeout: CLI_SUBPROCESS_TIMEOUTS.spawnMs
+    });
+    return classifyCodexStdout(stdout);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (/ENOENT|not found/i.test(msg)) {
+      return { cli: "codex", state: "not-installed", reason: "codex binary not on PATH" };
+    }
+    return codexNeedsLogin("Not logged in (codex login status returned non-zero)");
+  }
+}
+function geminiNeedsLogin(reason) {
+  return {
+    cli: "gemini",
+    state: "needs-login",
+    reason,
+    fixCommand: "gemini",
+    envFallback: "GOOGLE_AI_API_KEY",
+    fixUrl: "https://aistudio.google.com/apikey"
+  };
+}
+function classifyGeminiCreds(parsed) {
+  if (!isGeminiCredsShape(parsed)) {
+    return geminiNeedsLogin("OAuth credentials file present but not in expected shape");
+  }
+  if (typeof parsed.expiry_date === "number" && parsed.expiry_date < Date.now()) {
+    return geminiNeedsLogin(
+      `OAuth access token expired ${new Date(parsed.expiry_date).toISOString()} (refresh may still work)`
+    );
+  }
+  return {
+    cli: "gemini",
+    state: "authenticated",
+    via: "cli-credentials",
+    ...typeof parsed.expiry_date === "number" ? { meta: { expiresAt: parsed.expiry_date } } : {}
+  };
+}
+function probeGemini() {
+  const env = process.env["GOOGLE_AI_API_KEY"] ?? process.env["GEMINI_API_KEY"];
+  if (env !== void 0 && env !== "") {
+    return { cli: "gemini", state: "authenticated", via: "env-var" };
+  }
+  const credPath = join2(HOME, ".gemini", "oauth_creds.json");
+  if (!existsSync2(credPath)) {
+    return geminiNeedsLogin(
+      "No OAuth credentials at ~/.gemini/oauth_creds.json and GOOGLE_AI_API_KEY/GEMINI_API_KEY are not set"
+    );
+  }
+  try {
+    return classifyGeminiCreds(JSON.parse(readFileSync2(credPath, "utf-8")));
+  } catch (e) {
+    return {
+      cli: "gemini",
+      state: "error",
+      reason: `Failed to read gemini credentials: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
+async function probeOpencode() {
+  try {
+    const { stdout } = await execFileAsync("opencode", ["auth", "list"], {
+      timeout: CLI_SUBPROCESS_TIMEOUTS.spawnMs
+    });
+    if (/0 credentials/i.test(stdout)) {
+      return {
+        cli: "opencode",
+        state: "needs-login",
+        reason: "No providers configured in opencode",
+        fixCommand: "opencode auth login",
+        fixUrl: "https://opencode.ai/docs/config"
+      };
+    }
+    return { cli: "opencode", state: "authenticated", via: "cli-credentials" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (/ENOENT|not found/i.test(msg)) {
+      return { cli: "opencode", state: "not-installed", reason: "opencode binary not on PATH" };
+    }
+    return {
+      cli: "opencode",
+      state: "error",
+      reason: msg.split("\n")[0] ?? "opencode auth list failed"
+    };
+  }
+}
+function isClaudeCredsShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const oauth = v.claudeAiOauth;
+  if (typeof oauth !== "object" || oauth === null) return false;
+  return typeof oauth.accessToken === "string";
+}
+function isGeminiCredsShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  return typeof v.access_token === "string";
+}
+async function probeCli(cli) {
+  switch (cli) {
+    case "claude":
+      return Promise.resolve(probeClaude());
+    case "codex":
+      return probeCodex();
+    case "gemini":
+      return Promise.resolve(probeGemini());
+    case "opencode":
+      return probeOpencode();
+  }
+}
+async function probeAllClis() {
+  const clis = ["claude", "gemini", "codex", "opencode"];
+  return Promise.all(clis.map((c) => probeCli(c)));
+}
+
 // src/cli/doctor.ts
 var REQUIRED_NODE_MAJOR2 = 22;
 var API_KEY_VARS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GOOGLE_AI_API_KEY"];
@@ -1783,8 +2020,9 @@ function detectAuthMethod(name) {
   };
   return authMethods[name];
 }
-function createHealthyResult(name, health, capacity) {
-  const authenticated = health.healthy;
+function createHealthyResult(name, health, authProbe, capacity) {
+  const versionOk = health.healthy;
+  const authenticated = versionOk && authProbe.state === "authenticated";
   const result = {
     name,
     installed: true,
@@ -1797,6 +2035,13 @@ function createHealthyResult(name, health, capacity) {
   if (health.message !== void 0 && health.message !== "") {
     return { ...result, error: health.message };
   }
+  if (!authenticated && authProbe.state === "needs-login") {
+    return {
+      ...result,
+      error: authProbe.reason,
+      fix: authProbe.fixCommand
+    };
+  }
   if (!authenticated) {
     return { ...result, fix: getFixCommand(name, "auth") };
   }
@@ -1812,14 +2057,14 @@ async function checkCli(name) {
     return createNotFoundResult(name, "Adapter not available");
   }
   try {
-    const health = await adapter.healthCheck();
+    const [health, authProbe] = await Promise.all([adapter.healthCheck(), probeCli(name)]);
     let capacity;
     try {
       capacity = await adapter.getCapacity();
     } catch (capErr) {
       void capErr;
     }
-    return createHealthyResult(name, health, capacity);
+    return createHealthyResult(name, health, authProbe, capacity);
   } catch (error) {
     const message = getErrorMessage(error);
     const isNotFound = message.includes("ENOENT") || message.includes("not found");
@@ -1843,7 +2088,7 @@ function checkApiKeys() {
 }
 function checkConfigFile() {
   for (const configPath of CONFIG_FILE_PATHS) {
-    if (existsSync2(configPath)) {
+    if (existsSync3(configPath)) {
       return { found: true, path: configPath };
     }
   }
@@ -1865,27 +2110,45 @@ function buildRegistryAdvisory(cliResults) {
     const reason = available ? `${cliName} CLI is installed` : `${cliName} CLI is not installed`;
     return { modelId: m.id, displayName: m.displayName, cliName, available, reason };
   });
-  const STALE_THRESHOLD_DAYS = 30;
+  const STALE_THRESHOLD_DAYS = 90;
   const updatedAt = new Date(DEFAULT_MODEL_CAPABILITIES.updatedAt);
   const nowMs = getTimeProvider().now();
   const ageDays = Math.floor((nowMs - updatedAt.getTime()) / (1e3 * 60 * 60 * 24));
+  const isFreshInstall = !hasPriorUsage();
+  const exceedsThreshold = ageDays > STALE_THRESHOLD_DAYS;
   return {
     totalModels: models.length,
     availableModels: models.filter((m) => m.available).length,
     unavailableModels: models.filter((m) => !m.available).length,
     models,
     registryAgeDays: ageDays,
-    registryStale: ageDays > STALE_THRESHOLD_DAYS
+    registryStale: exceedsThreshold && !isFreshInstall
   };
 }
+function hasPriorUsage() {
+  try {
+    const root = getNexusDataDir();
+    if (!existsSync3(root)) return false;
+    for (const sub of ["audit", "learning", "sessions", "voting"]) {
+      const p = `${root}/${sub}`;
+      try {
+        if (existsSync3(p) && readdirSync(p).length > 0) return true;
+      } catch {
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
 function countJsonlLines(filePath) {
-  if (!existsSync2(filePath)) return 0;
-  return readFileSync2(filePath, "utf-8").split("\n").filter((l) => l.trim().length > 0).length;
+  if (!existsSync3(filePath)) return 0;
+  return readFileSync3(filePath, "utf-8").split("\n").filter((l) => l.trim().length > 0).length;
 }
 function readRulesMetadata(filePath) {
-  if (!existsSync2(filePath)) return { count: 0, savedAt: null };
+  if (!existsSync3(filePath)) return { count: 0, savedAt: null };
   try {
-    const raw = JSON.parse(readFileSync2(filePath, "utf-8"));
+    const raw = JSON.parse(readFileSync3(filePath, "utf-8"));
     const rules = raw["rules"];
     const saved = raw["savedAt"];
     return {
@@ -1897,7 +2160,7 @@ function readRulesMetadata(filePath) {
   }
 }
 function checkDirAccess(dir) {
-  const exists = existsSync2(dir);
+  const exists = existsSync3(dir);
   if (!exists) return { exists: false, writable: false };
   try {
     accessSync(dir, fsConstants.W_OK);
@@ -1957,10 +2220,10 @@ async function checkSqlite() {
 }
 function checkDataDirectory() {
   const rootPath = getNexusDataDir();
-  const rootExists = existsSync2(rootPath);
+  const rootExists = existsSync3(rootPath);
   const subdirectories = DATA_SUBDIRECTORIES.map((name) => {
-    const fullPath = join2(rootPath, name);
-    const exists = existsSync2(fullPath);
+    const fullPath = join3(rootPath, name);
+    const exists = existsSync3(fullPath);
     return { name, path: fullPath, exists, writable: exists && isWritable(fullPath) };
   });
   return { rootExists, rootPath, subdirectories };
@@ -1973,6 +2236,24 @@ function isWritable(dirPath) {
     return false;
   }
 }
+function checkSandbox() {
+  const info = detectSandbox();
+  const dataDir = getNexusDataDir();
+  const root = info.root;
+  const dataDirInsideRepo = info.active && root !== void 0 && dataDir.startsWith(`${root.replace(/\/$/, "")}/`) && // path segments BETWEEN root and `.nexus-agents/` indicate the data dir
+  // lives in a subfolder rather than at the multi-repo root.
+  dataDir.replace(`${root.replace(/\/$/, "")}/`, "").split("/").length > 1;
+  const heuristicSaysContainer = info.heuristicMatch === "docker" || info.heuristicMatch === "podman";
+  const mismatch = info.active && info.heuristicMatch === "unknown" || !info.active && heuristicSaysContainer;
+  return {
+    active: info.active,
+    flavor: info.flavor,
+    root: info.root,
+    heuristicMatch: info.heuristicMatch,
+    mismatch,
+    dataDirInsideRepo
+  };
+}
 async function runDoctor() {
   const clis = await Promise.all([
     checkCli("claude"),
@@ -1990,6 +2271,7 @@ async function runDoctor() {
   const learningPersistence = checkLearningPersistence();
   const sqliteCheck = await checkSqlite();
   const dataDirectory = checkDataDirectory();
+  const sandbox = checkSandbox();
   const hasAuthMethod = apiKeys.some((k) => k.configured) || clis.some((c) => c.installed && c.authenticated);
   const allHealthy = nodeVersion.supported && hasAuthMethod && mcpServerReady && clis.every((c) => c.installed && c.authenticated && c.versionStatus !== "unsupported");
   return {
@@ -2003,6 +2285,7 @@ async function runDoctor() {
     learningPersistence,
     sqliteCheck,
     dataDirectory,
+    sandbox,
     allHealthy,
     timestamp: new Date(getTimeProvider().now())
   };
@@ -2024,7 +2307,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-5VGIQETA.js");
+    const { runSetup } = await import("./setup-command-BWUFMZ7U.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2038,7 +2321,7 @@ async function runDoctorFix(result) {
     }
   }
   if (!result.configFile.found) {
-    const { runConfigInitSync } = await import("./setup-config-EA5RDIO2.js");
+    const { runConfigInitSync } = await import("./setup-config-E3JZYSLR.js");
     const configResult = runConfigInitSync(process.cwd(), false, false);
     if (configResult.success && configResult.created) {
       writeLine2(`\u2713 Generated config: ${configResult.path}`);
@@ -2071,7 +2354,7 @@ function initDataDirectories(dryRun = false) {
     ensureDir(NEXUS_DATA_DIR, dryRun, created, alreadyExisted);
     for (const subdir of DATA_SUBDIRECTORIES) {
       const mode = RESTRICTED_DIRS.has(subdir) ? 448 : void 0;
-      ensureDir(join3(NEXUS_DATA_DIR, subdir), dryRun, created, alreadyExisted, mode);
+      ensureDir(join4(NEXUS_DATA_DIR, subdir), dryRun, created, alreadyExisted, mode);
     }
     return { success: true, rootPath: NEXUS_DATA_DIR, created, alreadyExisted, error: null };
   } catch (error) {
@@ -2080,7 +2363,7 @@ function initDataDirectories(dryRun = false) {
   }
 }
 function ensureDir(dirPath, dryRun, created, alreadyExisted, mode) {
-  if (existsSync3(dirPath)) {
+  if (existsSync4(dirPath)) {
     alreadyExisted.push(dirPath);
     return;
   }
@@ -2122,6 +2405,7 @@ export {
   filterAvailableModels,
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl,
+  probeAllClis,
   DATA_SUBDIRECTORIES,
   checkApiKeys,
   checkSqlite,
@@ -2134,4 +2418,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-U6BK5DQU.js.map
+//# sourceMappingURL=chunk-YOREAPF6.js.map