nexus-agents 8.28.2 → 8.28.3

package/dist/{chunk-5C5SHEOU.js → chunk-BGTLVDIA.js}

@@ -8,7 +8,7 @@ import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-32L5P7ST.js";
+} from "./chunk-M43MLPU7.js";
 import {
   capitalize
 } from "./chunk-7LP6VJRP.js";
@@ -1228,7 +1228,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-HL2BZZGS.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-YG36WJ5S.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1330,4 +1330,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-5C5SHEOU.js.map
+//# sourceMappingURL=chunk-BGTLVDIA.js.map

package/dist/{chunk-6BZWANJE.js → chunk-GGZJIWAF.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-BRDADDGN.js";
+} from "./chunk-KVWPOZEX.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2159,4 +2159,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-6BZWANJE.js.map
+//# sourceMappingURL=chunk-GGZJIWAF.js.map

package/dist/{chunk-TXMTK42U.js → chunk-IPU5MBXQ.js}

@@ -23,10 +23,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-BRDADDGN.js";
+} from "./chunk-KVWPOZEX.js";
 import {
   VERSION
-} from "./chunk-32L5P7ST.js";
+} from "./chunk-M43MLPU7.js";
 import {
   assessPanelIndependence,
   countDistinctModels,
@@ -7683,4 +7683,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-TXMTK42U.js.map
+//# sourceMappingURL=chunk-IPU5MBXQ.js.map

package/dist/{chunk-BRDADDGN.js → chunk-KVWPOZEX.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-32L5P7ST.js";
+} from "./chunk-M43MLPU7.js";
 import {
   emitClawGuardViolation
 } from "./chunk-5XYODQTD.js";
@@ -2255,4 +2255,4 @@ export {
   VOTING_THRESHOLDS,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-BRDADDGN.js.map
+//# sourceMappingURL=chunk-KVWPOZEX.js.map

package/dist/{chunk-32L5P7ST.js → chunk-M43MLPU7.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import semver from "semver";
-var VERSION = true ? "8.28.2" : "dev";
+var VERSION = true ? "8.28.3" : "dev";
 var NODE_ENGINE_RANGE = ">=22.5.0";
 function isNodeVersionSupported(version) {
   return semver.satisfies(version, NODE_ENGINE_RANGE);
@@ -11,4 +11,4 @@ export {
   NODE_ENGINE_RANGE,
   isNodeVersionSupported
 };
-//# sourceMappingURL=chunk-32L5P7ST.js.map
+//# sourceMappingURL=chunk-M43MLPU7.js.map

package/dist/{chunk-Z6UJ7Y3N.js → chunk-NHOXP5EN.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-5C5SHEOU.js";
+} from "./chunk-BGTLVDIA.js";
 import {
   executeExpert
 } from "./chunk-VQGUGZPR.js";
@@ -55,7 +55,7 @@ import {
   toJobSummary,
   updateStage,
   writeJobCancelled
-} from "./chunk-TXMTK42U.js";
+} from "./chunk-IPU5MBXQ.js";
 import {
   allOf,
   anyOf
@@ -75,7 +75,7 @@ import {
 } from "./chunk-2EITSDXF.js";
 import {
   withPrerequisite
-} from "./chunk-6BZWANJE.js";
+} from "./chunk-GGZJIWAF.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -100,7 +100,7 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-BRDADDGN.js";
+} from "./chunk-KVWPOZEX.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
@@ -1020,8 +1020,13 @@ var NexusEnvSchema = z11.object({
   NEXUS_TMPDIR: z11.string().optional(),
   // ClawGuard access-policy mode.
   NEXUS_ACCESS_POLICY_MODE: z11.enum(["off", "audit", "confirm_risky", "enforce"]).optional(),
-  // Sandbox mode (epic #2500).
-  NEXUS_SANDBOX: boolStr.optional(),
+  // Sandbox FLAVOR string (`docker-opencode`, `codex`, …), set by the host
+  // image so sandbox-detection knows it is inside one (epic #2500, #5026). It
+  // was registered as a boolean while every producer and reader used a flavor
+  // string, so the documented value warned as invalid at startup (#5695).
+  // Empty is the POSIX idiom for "override the image's export and turn it off";
+  // sandbox-detection reads empty as unset, so the validator accepts it too.
+  NEXUS_SANDBOX: z11.string().optional(),
   NEXUS_SANDBOX_ROOT: z11.string().optional(),
   NEXUS_ALLOW_MOCK_ORCHESTRATION: boolStr.optional(),
   // Explicit opt-in for simulateVotes outside test runners (#4170) — read by
@@ -45689,7 +45694,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-QLS5K6KB.js");
+    const { executeVoting } = await import("./consensus-vote-XMNIGTYB.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47481,7 +47486,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-QLS5K6KB.js");
+        const { executeVoting } = await import("./consensus-vote-XMNIGTYB.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -55425,14 +55430,14 @@ function createDeprecatedModeFallback(requestedMode, policyConfig) {
   logger52.warn(`Sandbox mode "${requestedMode}" is no longer supported; using "policy" mode`, {
     requestedMode,
     actualMode: "policy",
-    reason: "In-process Docker/Deno executors were deleted in #2551. Use the OpenCode sandbox bootstrap for real isolation (NEXUS_SANDBOX environment variable, see docs/guides/SANDBOXED-USAGE.md)."
+    reason: "In-process Docker/Deno executors were deleted in #2551. For real isolation run inside the OpenCode Docker image (docs/guides/SANDBOXED-USAGE.md); the NEXUS_SANDBOX variable only tells nexus-agents it is inside one, it does not confine anything (#5026)."
   });
   const executor = new PolicySandboxExecutor(policyConfig);
   return {
     executor,
     actualMode: "policy",
     usedFallback: true,
-    warning: `Sandbox mode "${requestedMode}" is no longer supported; using "policy" mode. For real isolation, use the NEXUS_SANDBOX bootstrap.`
+    warning: `Sandbox mode "${requestedMode}" is no longer supported; using "policy" mode. For real isolation run inside the OpenCode Docker image (docs/guides/SANDBOXED-USAGE.md); NEXUS_SANDBOX only signals that you are inside one.`
   };
 }
 
@@ -56197,4 +56202,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-Z6UJ7Y3N.js.map
+//# sourceMappingURL=chunk-NHOXP5EN.js.map