nexus-agents 2.77.13 → 2.78.0

package/dist/chunk-GOT7OAL5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/config/nexus-data-dir.ts","../src/config/sandbox-detection.ts"],"sourcesContent":["/**\n * Nexus runtime data directory resolver (#2302, child of #2301).\n *\n * Returns the absolute path under which nexus-agents stores all runtime\n * state — memory, learning, audit, voting, sessions, checkpoints, traces,\n * model registry. Single source of truth so portable / sandbox / CI\n * deployments can redirect state to a workspace-local folder via the\n * `NEXUS_DATA_DIR` environment variable.\n *\n * Resolution order (first match wins):\n * 1. `NEXUS_DATA_DIR` env var if set + non-empty (resolved against `cwd`).\n * 2. Sandbox-mode default (#2501): when `NEXUS_SANDBOX` is set, use\n *    `${NEXUS_SANDBOX_ROOT ?? '/'}/.nexus-agents`. Sandboxed deployments\n *    typically mount a multi-repo root; state goes there, shared across\n *    repo subfolders rather than buried inside one.\n * 3. `<homedir>/.nexus-agents` (zero-breakage fallback for laptop use).\n *\n * No caching, no filesystem walks, no discovery. The contrarian-narrowed\n * scope (#2301 vote) explicitly defers ancestor-walking to a separate\n * child with a security design pass per CVE-2022-24765. Recomputing the\n * trivial env-or-homedir lookup on each call is ~100ns and avoids cache\n * coordination issues with tests that mock `homedir()`.\n *\n * @module config/nexus-data-dir\n */\n\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\n\nimport { detectSandbox } from './sandbox-detection.js';\n\n/** Returns the absolute path to the nexus-agents data directory. */\nexport function getNexusDataDir(): string {\n  const fromEnv = process.env['NEXUS_DATA_DIR']?.trim();\n  if (fromEnv !== undefined && fromEnv !== '') {\n    return resolve(fromEnv);\n  }\n  const sandbox = detectSandbox();\n  if (sandbox.active) {\n    return resolve(sandbox.root ?? '/', '.nexus-agents');\n  }\n  return join(homedir(), '.nexus-agents');\n}\n\n/**\n * No-op kept for source-compatibility with consumers that called this\n * earlier in development. The resolver is no longer cached, so resetting\n * is unnecessary. Kept exported (rather than removed) to avoid breaking\n * imports in tests that may have already adopted it.\n */\nexport function resetNexusDataDirCache(): void {\n  // intentionally empty — see module docstring\n}\n\n/** Returns a path joined under the resolved data directory. */\nexport function nexusDataPath(...segments: string[]): string {\n  return join(getNexusDataDir(), ...segments);\n}\n","/**\n * Sandbox detection (#2501, child 1 of epic #2500).\n *\n * nexus-agents needs to know whether it's running inside a host-provided\n * sandbox (Docker Desktop Sandbox + OpenCode, Codex sandbox, locked-down\n * CI runner) so it can adjust behaviour:\n *\n *   - default `NEXUS_DATA_DIR` to the multi-repo root rather than `~/...`\n *   - skip CLI subprocess detection (binaries aren't there)\n *   - fail-fast when the gateway is unreachable instead of degrading\n *   - suppress diagnostics that don't apply\n *\n * The signal is **explicit**: the image author (Dockerfile, devcontainer,\n * harness wrapper) sets `NEXUS_SANDBOX=<flavor>`. The flavor string is\n * for diagnostics + per-flavor branching (`docker-opencode`, `codex`,\n * `claude-code`, `ci-restricted`, …); presence is the on/off signal.\n *\n * A heuristic check runs alongside for verification — if `NEXUS_SANDBOX`\n * claims `docker-opencode` but `/.dockerenv` is missing, that's a\n * misconfiguration worth surfacing to the operator.\n *\n * @module config/sandbox-detection\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\n\n/**\n * Heuristic detection result. Independent from the explicit\n * `NEXUS_SANDBOX` env var; produced by inspecting filesystem markers.\n */\nexport type SandboxHeuristic = 'docker' | 'podman' | 'unknown' | null;\n\nexport interface SandboxInfo {\n  /**\n   * True iff `NEXUS_SANDBOX` is set + non-empty. The explicit signal\n   * the rest of the codebase keys off — never `true` by heuristic alone.\n   */\n  readonly active: boolean;\n  /**\n   * Operator-supplied flavor string, e.g. `docker-opencode`. Undefined\n   * when `active === false` or the env var is empty.\n   */\n  readonly flavor: string | undefined;\n  /**\n   * Multi-repo root the user mounted. From `NEXUS_SANDBOX_ROOT`. Undefined\n   * when unset; consumers that need a default substitute `/`.\n   */\n  readonly root: string | undefined;\n  /**\n   * Independent heuristic match — `null` when we couldn't run the check,\n   * `'unknown'` when ran but no marker matched. Used by `doctor` to flag\n   * mismatches between the explicit signal and the runtime environment.\n   */\n  readonly heuristicMatch: SandboxHeuristic;\n}\n\n/**\n * Detect whether nexus-agents is running inside a host-provided sandbox.\n * Pure read of env + filesystem; no caching (cheap enough to recompute,\n * and tests routinely mutate process.env).\n */\nexport function detectSandbox(): SandboxInfo {\n  const flavorRaw = process.env['NEXUS_SANDBOX']?.trim();\n  const flavor = flavorRaw !== undefined && flavorRaw !== '' ? flavorRaw : undefined;\n  const active = flavor !== undefined;\n\n  const rootRaw = process.env['NEXUS_SANDBOX_ROOT']?.trim();\n  const root = rootRaw !== undefined && rootRaw !== '' ? rootRaw : undefined;\n\n  return {\n    active,\n    flavor,\n    root,\n    heuristicMatch: detectContainerHeuristic(),\n  };\n}\n\n/**\n * Look for filesystem markers indicating a container runtime. Used as a\n * cross-check against the explicit `NEXUS_SANDBOX` signal.\n *\n * Order of checks:\n *   1. `/.dockerenv` (Docker)\n *   2. `/run/.containerenv` (Podman)\n *   3. `/proc/1/cgroup` containing `docker` or `containerd` strings\n *\n * Returns `null` when none of the checks could run (non-Linux host with\n * no `/proc`, sandbox blocks `existsSync`, etc.) — distinct from\n * `'unknown'` (checks ran, no marker matched) so the doctor message can\n * differentiate \"we couldn't tell\" from \"we checked, no container\".\n */\nfunction detectContainerHeuristic(): SandboxHeuristic {\n  try {\n    if (existsSync('/.dockerenv')) return 'docker';\n    if (existsSync('/run/.containerenv')) return 'podman';\n    if (existsSync('/proc/1/cgroup')) {\n      const cgroup = readFileSync('/proc/1/cgroup', 'utf8');\n      if (/\\bdocker\\b/.test(cgroup)) return 'docker';\n      if (/\\bcontainerd\\b/.test(cgroup)) return 'docker';\n    }\n    return 'unknown';\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AA0BA,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;;;ACH9B,SAAS,YAAY,oBAAoB;AAqClC,SAAS,gBAA6B;AAC3C,QAAM,YAAY,QAAQ,IAAI,eAAe,GAAG,KAAK;AACrD,QAAM,SAAS,cAAc,UAAa,cAAc,KAAK,YAAY;AACzE,QAAM,SAAS,WAAW;AAE1B,QAAM,UAAU,QAAQ,IAAI,oBAAoB,GAAG,KAAK;AACxD,QAAM,OAAO,YAAY,UAAa,YAAY,KAAK,UAAU;AAEjE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,yBAAyB;AAAA,EAC3C;AACF;AAgBA,SAAS,2BAA6C;AACpD,MAAI;AACF,QAAI,WAAW,aAAa,EAAG,QAAO;AACtC,QAAI,WAAW,oBAAoB,EAAG,QAAO;AAC7C,QAAI,WAAW,gBAAgB,GAAG;AAChC,YAAM,SAAS,aAAa,kBAAkB,MAAM;AACpD,UAAI,aAAa,KAAK,MAAM,EAAG,QAAO;AACtC,UAAI,iBAAiB,KAAK,MAAM,EAAG,QAAO;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADxEO,SAAS,kBAA0B;AACxC,QAAM,UAAU,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AACpD,MAAI,YAAY,UAAa,YAAY,IAAI;AAC3C,WAAO,QAAQ,OAAO;AAAA,EACxB;AACA,QAAM,UAAU,cAAc;AAC9B,MAAI,QAAQ,QAAQ;AAClB,WAAO,QAAQ,QAAQ,QAAQ,KAAK,eAAe;AAAA,EACrD;AACA,SAAO,KAAK,QAAQ,GAAG,eAAe;AACxC;AAQO,SAAS,yBAA+B;AAE/C;AAGO,SAAS,iBAAiB,UAA4B;AAC3D,SAAO,KAAK,gBAAgB,GAAG,GAAG,QAAQ;AAC5C;","names":[]}

package/dist/chunk-I7ORMAO7.js

@@ -1,32 +0,0 @@
-import {
-  getNexusDataDir
-} from "./chunk-GOT7OAL5.js";
-
-// src/config/learning-persistence.ts
-import { mkdirSync } from "fs";
-import { join } from "path";
-function getLearningDir() {
-  return join(getNexusDataDir(), "learning");
-}
-function getOutcomesFile() {
-  return join(getLearningDir(), "outcomes.jsonl");
-}
-function getRulesFile() {
-  return join(getLearningDir(), "rules.json");
-}
-var DIR_MODE = 448;
-function isPersistenceEnabled() {
-  return process.env["NEXUS_PERSIST_LEARNING"] !== "false";
-}
-function ensureLearningDir(dir) {
-  mkdirSync(dir ?? getLearningDir(), { recursive: true, mode: DIR_MODE });
-}
-
-export {
-  getLearningDir,
-  getOutcomesFile,
-  getRulesFile,
-  isPersistenceEnabled,
-  ensureLearningDir
-};
-//# sourceMappingURL=chunk-I7ORMAO7.js.map

package/dist/chunk-I7ORMAO7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/config/learning-persistence.ts"],"sourcesContent":["/**\n * Shared configuration for cross-session learning persistence.\n *\n * Controls where learning data (outcomes, distilled rules) is stored\n * on disk and whether persistence is enabled via feature flag.\n *\n * @module config/learning-persistence\n * (Source: Issue #1009 — Cross-session persistence)\n */\n\nimport { mkdirSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { getNexusDataDir } from './nexus-data-dir.js';\n\n// ============================================================================\n// Path resolution (#2316: must read NEXUS_DATA_DIR at call time, not import)\n// ============================================================================\n\n/**\n * Base directory for learning persistence data. Resolved at call time so\n * `NEXUS_DATA_DIR` overrides take effect — the const-at-import-time\n * pattern this replaces was the bug discovered while dogfooding v2.63.0\n * (#2316). Outcome counts on a fresh portable workspace were leaking\n * the host home directory's outcome history.\n */\nexport function getLearningDir(): string {\n  return join(getNexusDataDir(), 'learning');\n}\n\n/** JSONL file for persisted task outcomes. */\nexport function getOutcomesFile(): string {\n  return join(getLearningDir(), 'outcomes.jsonl');\n}\n\n/** JSON file for persisted distilled rules. */\nexport function getRulesFile(): string {\n  return join(getLearningDir(), 'rules.json');\n}\n\n// Note: previous LEARNING_DIR / OUTCOMES_FILE / RULES_FILE exports were\n// removed in #2316 — they were evaluated at module import time and ignored\n// `NEXUS_DATA_DIR`. All callers must use the getter functions above.\n\n/** Directory mode: owner-only (rwx------). */\nconst DIR_MODE = 0o700;\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\n/**\n * Check whether learning persistence is enabled via feature flag.\n *\n * Defaults to true — cross-session LinUCB routing data persists to\n * `~/.nexus-agents/learning/` unless explicitly disabled.\n * Only routing metadata is stored (model, success, duration, category).\n * No user prompts, API keys, or model outputs are persisted.\n *\n * Set NEXUS_PERSIST_LEARNING=false to disable.\n */\nexport function isPersistenceEnabled(): boolean {\n  return process.env['NEXUS_PERSIST_LEARNING'] !== 'false';\n}\n\n/** Ensure the learning data directory exists. */\nexport function ensureLearningDir(dir?: string): void {\n  mkdirSync(dir ?? getLearningDir(), { recursive: true, mode: DIR_MODE });\n}\n"],"mappings":";;;;;AAUA,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AAcd,SAAS,iBAAyB;AACvC,SAAO,KAAK,gBAAgB,GAAG,UAAU;AAC3C;AAGO,SAAS,kBAA0B;AACxC,SAAO,KAAK,eAAe,GAAG,gBAAgB;AAChD;AAGO,SAAS,eAAuB;AACrC,SAAO,KAAK,eAAe,GAAG,YAAY;AAC5C;AAOA,IAAM,WAAW;AAgBV,SAAS,uBAAgC;AAC9C,SAAO,QAAQ,IAAI,wBAAwB,MAAM;AACnD;AAGO,SAAS,kBAAkB,KAAoB;AACpD,YAAU,OAAO,eAAe,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AACxE;","names":[]}