nexus-agents 8.28.2 → 8.28.4

package/dist/{chunk-MZOXHJCW.js → chunk-UCOCWVFT.js}

@@ -5,7 +5,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-AMIRFMFC.js";
+} from "./chunk-TME26QKQ.js";
 import {
   findRepoRoot,
   getActiveWorkspaceRoot,
@@ -223,4 +223,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-MZOXHJCW.js.map
+//# sourceMappingURL=chunk-UCOCWVFT.js.map

package/dist/{chunk-32L5P7ST.js → chunk-UTALVWRN.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import semver from "semver";
-var VERSION = true ? "8.28.2" : "dev";
+var VERSION = true ? "8.28.4" : "dev";
 var NODE_ENGINE_RANGE = ">=22.5.0";
 function isNodeVersionSupported(version) {
   return semver.satisfies(version, NODE_ENGINE_RANGE);
@@ -11,4 +11,4 @@ export {
   NODE_ENGINE_RANGE,
   isNodeVersionSupported
 };
-//# sourceMappingURL=chunk-32L5P7ST.js.map
+//# sourceMappingURL=chunk-UTALVWRN.js.map

package/dist/{chunk-Z6UJ7Y3N.js → chunk-UUULOA5M.js}

@@ -1,6 +1,6 @@
 import {
   generateSecurityPlan
-} from "./chunk-GIE4QGEL.js";
+} from "./chunk-VXVS66SH.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-DGWT7DXX.js";
@@ -21,10 +21,10 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-5C5SHEOU.js";
+} from "./chunk-BALXYZTD.js";
 import {
   executeExpert
-} from "./chunk-VQGUGZPR.js";
+} from "./chunk-2PHZFAII.js";
 import {
   JobStatusSchema,
   VOTER_ROLES,
@@ -55,7 +55,7 @@ import {
   toJobSummary,
   updateStage,
   writeJobCancelled
-} from "./chunk-TXMTK42U.js";
+} from "./chunk-HXZ2A6VE.js";
 import {
   allOf,
   anyOf
@@ -63,19 +63,19 @@ import {
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-PBMQEUMG.js";
+} from "./chunk-JARNYJYL.js";
 import {
   IssueTriage,
   createDurableAuditSink,
   createDurableAuditTrail
-} from "./chunk-SR3MQ2GG.js";
+} from "./chunk-ILTFBXCX.js";
 import {
   resolveEnvMode,
   sanitizeInput
-} from "./chunk-2EITSDXF.js";
+} from "./chunk-76AEYPGB.js";
 import {
   withPrerequisite
-} from "./chunk-6BZWANJE.js";
+} from "./chunk-SM3JXK6E.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -100,18 +100,18 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-BRDADDGN.js";
+} from "./chunk-WHXKVYQF.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
   emitPipelinePolicyEvent
-} from "./chunk-5XYODQTD.js";
+} from "./chunk-OA4PUO4V.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-DCD6WNPJ.js";
+} from "./chunk-FTMN6UMD.js";
 import {
   IDENTIFIER_RE,
   LANG_VALUES,
@@ -144,7 +144,7 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-SX3DXUQV.js";
+} from "./chunk-CFRWFP2Y.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
@@ -152,25 +152,25 @@ import {
   loadTechniquesRegistry,
   resolveInsideRoot,
   resolveRegistryRoot
-} from "./chunk-MZOXHJCW.js";
+} from "./chunk-UCOCWVFT.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-LQ7CMUN4.js";
+} from "./chunk-DGHKIJX3.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
   MemoryType,
   calculateTextJaccardSimilarity,
   getToolMemory
-} from "./chunk-RRZ5PGJA.js";
+} from "./chunk-ATO5WYUK.js";
 import {
   STOPWORDS,
   truncateWithInfo
 } from "./chunk-7LP6VJRP.js";
 import {
   createSessionMemory
-} from "./chunk-HDXB5U74.js";
+} from "./chunk-4LPUI2VD.js";
 import {
   BUILT_IN_EXPERTS,
   BuiltInExpertTypeSchema,
@@ -188,25 +188,25 @@ import {
   getAvailableClis,
   sleep,
   withTimeout
-} from "./chunk-VNGVFKYD.js";
+} from "./chunk-PNVKH7JD.js";
 import {
   BaseAdapter,
   createStream,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-56WJLZ5I.js";
+} from "./chunk-5YKKV4BT.js";
 import {
   DEFAULTS
-} from "./chunk-HMBI27U4.js";
+} from "./chunk-KFRIU2O6.js";
 import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-3RILNEWZ.js";
+} from "./chunk-242MYZDF.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-2DSRYCHY.js";
+} from "./chunk-NJHK4YTE.js";
 import {
   AGENT_ROUTER_TIMEOUTS,
   API_TIMEOUTS,
@@ -312,7 +312,7 @@ import {
   selectStrategyByManifest,
   toExpertTaskAnalysisResult,
   withStep
-} from "./chunk-AMIRFMFC.js";
+} from "./chunk-TME26QKQ.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -1020,8 +1020,13 @@ var NexusEnvSchema = z11.object({
   NEXUS_TMPDIR: z11.string().optional(),
   // ClawGuard access-policy mode.
   NEXUS_ACCESS_POLICY_MODE: z11.enum(["off", "audit", "confirm_risky", "enforce"]).optional(),
-  // Sandbox mode (epic #2500).
-  NEXUS_SANDBOX: boolStr.optional(),
+  // Sandbox FLAVOR string (`docker-opencode`, `codex`, …), set by the host
+  // image so sandbox-detection knows it is inside one (epic #2500, #5026). It
+  // was registered as a boolean while every producer and reader used a flavor
+  // string, so the documented value warned as invalid at startup (#5695).
+  // Empty is the POSIX idiom for "override the image's export and turn it off";
+  // sandbox-detection reads empty as unset, so the validator accepts it too.
+  NEXUS_SANDBOX: z11.string().optional(),
   NEXUS_SANDBOX_ROOT: z11.string().optional(),
   NEXUS_ALLOW_MOCK_ORCHESTRATION: boolStr.optional(),
   // Explicit opt-in for simulateVotes outside test runners (#4170) — read by
@@ -29882,7 +29887,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-45HON52O.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-GA2AOW3O.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -45287,7 +45292,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-U6DTKFH7.js");
+    const { createIssueTriage } = await import("./issue-triage-A3ZHZBB2.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num = issueMatch[2] ?? "";
@@ -45315,7 +45320,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-DLO63EKU.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-5HR42Y5A.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -45689,7 +45694,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-QLS5K6KB.js");
+    const { executeVoting } = await import("./consensus-vote-54SPKHVA.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -47248,7 +47253,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-BFJEA6NL.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-DTZ66VSH.js");
     const { getLearningDir } = await import("./learning-persistence-TX2WE7Y7.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -47310,7 +47315,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-ZQVP734Q.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-DOAENN2D.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -47344,7 +47349,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-IKCYZAZ3.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-MZDEPXYC.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -47362,7 +47367,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-BFJEA6NL.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-DTZ66VSH.js");
     const { getLearningDir } = await import("./learning-persistence-TX2WE7Y7.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -47481,7 +47486,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-QLS5K6KB.js");
+        const { executeVoting } = await import("./consensus-vote-54SPKHVA.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -47912,7 +47917,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-3VMID7KI.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-LOZ5V44B.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -47983,7 +47988,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-IXCSU2IU.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-2DUVHZF7.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -51217,7 +51222,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-OGOLQSYT.js");
+    const { createScmProvider } = await import("./factory-VMEYE73K.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -52121,7 +52126,7 @@ async function probeSource(source, includeModelIds) {
   }
 }
 async function defaultSources(includeOpenRouter) {
-  const { createAllAdapters: createAllAdapters2 } = await import("./factory-JRPJZXSI.js");
+  const { createAllAdapters: createAllAdapters2 } = await import("./factory-4Z5LEEZ4.js");
   const adapters = createAllAdapters2();
   return buildDefaultModelSources(adapters, { includeOpenRouter });
 }
@@ -55425,14 +55430,14 @@ function createDeprecatedModeFallback(requestedMode, policyConfig) {
   logger52.warn(`Sandbox mode "${requestedMode}" is no longer supported; using "policy" mode`, {
     requestedMode,
     actualMode: "policy",
-    reason: "In-process Docker/Deno executors were deleted in #2551. Use the OpenCode sandbox bootstrap for real isolation (NEXUS_SANDBOX environment variable, see docs/guides/SANDBOXED-USAGE.md)."
+    reason: "In-process Docker/Deno executors were deleted in #2551. For real isolation run inside the OpenCode Docker image (docs/guides/SANDBOXED-USAGE.md); the NEXUS_SANDBOX variable only tells nexus-agents it is inside one, it does not confine anything (#5026)."
   });
   const executor = new PolicySandboxExecutor(policyConfig);
   return {
     executor,
     actualMode: "policy",
     usedFallback: true,
-    warning: `Sandbox mode "${requestedMode}" is no longer supported; using "policy" mode. For real isolation, use the NEXUS_SANDBOX bootstrap.`
+    warning: `Sandbox mode "${requestedMode}" is no longer supported; using "policy" mode. For real isolation run inside the OpenCode Docker image (docs/guides/SANDBOXED-USAGE.md); NEXUS_SANDBOX only signals that you are inside one.`
   };
 }
 
@@ -56197,4 +56202,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-Z6UJ7Y3N.js.map
+//# sourceMappingURL=chunk-UUULOA5M.js.map