nexus-agents 8.129.1 → 8.130.1

package/dist/{ast-rule-runner-FMDXT6UK.js → ast-rule-runner-OSBD2M57.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-E66LMCE2.js";
-import "./chunk-JXO3GQC7.js";
+} from "./chunk-GSR5QCPG.js";
+import "./chunk-7DGVMHTU.js";
 import "./chunk-XBEKMUTO.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
@@ -27,4 +27,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-FMDXT6UK.js.map
+//# sourceMappingURL=ast-rule-runner-OSBD2M57.js.map

package/dist/{child-mcp-config-SK6ZOTT2.js → child-mcp-config-6IQ6JS4A.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-JXO3GQC7.js";
+} from "./chunk-7DGVMHTU.js";
 import "./chunk-XBEKMUTO.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
@@ -50,4 +50,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-SK6ZOTT2.js.map
+//# sourceMappingURL=child-mcp-config-6IQ6JS4A.js.map

package/dist/{chunk-XUHCMRPD.js → chunk-2OU7UU5F.js}

@@ -1,6 +1,6 @@
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-2VXLAP5Z.js";
+} from "./chunk-PKZCMKZ7.js";
 import {
   nexusMkdtempSync
 } from "./chunk-OITVVSWO.js";
@@ -8,7 +8,7 @@ import {
   ensureGatewayDiscovered,
   gatewayDiscoveryStatus,
   getAvailabilityCache
-} from "./chunk-XFSH4AUV.js";
+} from "./chunk-5OQFHNKN.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -19,7 +19,7 @@ import {
   requireApiKey,
   validateApiKeyPresence,
   withGatewayUsageRecording
-} from "./chunk-SLC5SYYF.js";
+} from "./chunk-ASBO2CB4.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
@@ -28,22 +28,22 @@ import {
   readGatewayEnv,
   redactApiKey,
   validateCustomApiBaseUrl
-} from "./chunk-ZF4XIOOG.js";
+} from "./chunk-MWYA4NRL.js";
 import {
   sanitizeOutput
-} from "./chunk-IBT65YP4.js";
+} from "./chunk-KJIC4EXI.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-5YSXCPDD.js";
+} from "./chunk-C2TFMLW6.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
   getCliCircuitBreakerSnapshot,
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-LUQCX5UZ.js";
+} from "./chunk-KES4X4HO.js";
 import {
   CLI_NAMES,
   CLI_SUBPROCESS_TIMEOUTS,
@@ -118,7 +118,7 @@ import {
   unenforcedAccessModeRefusal,
   warnIfGatewayCostUndeclared,
   withEnforcedAccessMode
-} from "./chunk-JXO3GQC7.js";
+} from "./chunk-7DGVMHTU.js";
 import {
   parseBoolValue
 } from "./chunk-LWOX65CP.js";
@@ -2579,14 +2579,22 @@ var TIMEOUT_RETRY_MULTIPLIER = 1.5;
 function isTransientError(code) {
   return TRANSIENT_ERROR_CODES.has(code);
 }
-function spawnCliChild(cliName, cmdConfig, workDir) {
+function spawnCliChild(cliName, cmdConfig, task, timeoutMs) {
   const childEnv = { ...buildChildEnv(cliName), ...cmdConfig.env };
-  const cwd = spawnCwd(workDir);
+  const cwd = spawnCwd(task.options?.["workDir"]);
+  const wrapped = task.wrapper?.(cmdConfig.command, cmdConfig.args, {
+    cwd,
+    env: childEnv,
+    timeoutMs
+  });
+  const command = wrapped?.command ?? cmdConfig.command;
+  const args = wrapped?.args ?? cmdConfig.args;
+  const options = wrapped?.options ?? { cwd, env: childEnv };
   return trackProcessTree(
-    spawn(cmdConfig.command, cmdConfig.args, {
+    spawn(command, [...args], {
       stdio: ["pipe", "pipe", "pipe"],
-      env: childEnv,
-      ...cwd !== void 0 ? { cwd } : {}
+      env: options.env,
+      ...options.cwd !== void 0 ? { cwd: options.cwd } : {}
     })
   );
 }
@@ -2778,7 +2786,7 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
         resolveOuter(r);
       };
       try {
-        const child = spawnCliChild(this.name, cmdConfig, task.options?.["workDir"]);
+        const child = spawnCliChild(this.name, cmdConfig, task, options.timeoutMs);
         const onProgress = options.onProgress;
         const state = this.setupChildProcessHandlers({
           child,
@@ -4038,6 +4046,41 @@ function createCodexSandboxGuard(preflight, logger7, onSandboxArgs, platform = p
     ) : void 0;
   };
 }
+var BWRAP_READ_ONLY_ARGS = [
+  "--ro-bind",
+  "/",
+  "/",
+  "--dev",
+  "/dev",
+  "--proc",
+  "/proc",
+  "--unshare-pid",
+  "--die-with-parent",
+  "--new-session"
+];
+function createBwrapPreflight(exec2 = defaultExec, platform = process.platform) {
+  let cached2;
+  return () => cached2 ??= (async () => {
+    if (platform !== "linux") return { mode: "best-effort", reason: "bwrap requires Linux" };
+    try {
+      const result = await exec2(
+        "bwrap",
+        [...BWRAP_READ_ONLY_ARGS, "--", "true"],
+        Math.min(CLI_SUBPROCESS_TIMEOUTS.statusProbeMs, resolveClassGuardMs("interactive"))
+      );
+      if (result.exitCode === 0) return { mode: "os-sandbox" };
+      return {
+        mode: "best-effort",
+        reason: `bwrap probe failed: ${sanitizeOutput(result.stderr) || "no diagnostic output"}`
+      };
+    } catch (error) {
+      return {
+        mode: "best-effort",
+        reason: `bwrap probe failed: ${sanitizeOutput(getErrorMessage(error))}`
+      };
+    }
+  })();
+}
 
 // src/cli-adapters/parsers/codex-parser.ts
 var logger4 = createLogger({ component: "codex-parser" });
@@ -6087,6 +6130,8 @@ export {
   isAbsentSeat,
   CODEX_LEGACY_LANDLOCK_CONFIG,
   codexSandboxPreflight,
+  BWRAP_READ_ONLY_ARGS,
+  createBwrapPreflight,
   CodexResponseParser,
   CodexCliAdapter,
   CodexMcpAdapter,
@@ -6112,4 +6157,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-XUHCMRPD.js.map
+//# sourceMappingURL=chunk-2OU7UU5F.js.map