volute 0.38.0 → 0.40.0

package/dist/{activity-events-N6HCHU4P.js → activity-events-OJZ7G5CG.js}

@@ -3,10 +3,10 @@ import {
   broadcast,
   publish,
   subscribe
-} from "./chunk-N42QMDID.js";
+} from "./chunk-5VBXKFPO.js";
 import "./chunk-T2TP6ZC6.js";
-import "./chunk-2NHRJ3YO.js";
-import "./chunk-CJ26DXZL.js";
+import "./chunk-PDSA3ILI.js";
+import "./chunk-MHFAWJCC.js";
 import "./chunk-K3NQKI34.js";
 export {
   broadcast,

package/dist/{ai-service-C2YNARGH.js → ai-service-JMV4KZN4.js}

@@ -2,6 +2,7 @@
 import {
   aiComplete,
   aiCompleteUtility,
+  fireProviderRefreshHook,
   getAiConfig,
   getAvailableModels,
   getConfiguredProviders,
@@ -15,17 +16,19 @@ import {
   resolveTemplate,
   saveProviderConfig,
   setEnabledModels,
+  setProviderRefreshHook,
   setUtilityModel,
   unqualifyModelId
-} from "./chunk-ORNY3MZR.js";
-import "./chunk-A6FLW5XD.js";
+} from "./chunk-PGX52NFO.js";
+import "./chunk-2AQCEQYN.js";
 import "./chunk-T2TP6ZC6.js";
-import "./chunk-2NHRJ3YO.js";
-import "./chunk-CJ26DXZL.js";
+import "./chunk-PDSA3ILI.js";
+import "./chunk-MHFAWJCC.js";
 import "./chunk-K3NQKI34.js";
 export {
   aiComplete,
   aiCompleteUtility,
+  fireProviderRefreshHook,
   getAiConfig,
   getAvailableModels,
   getConfiguredProviders,
@@ -39,6 +42,7 @@ export {
   resolveTemplate,
   saveProviderConfig,
   setEnabledModels,
+  setProviderRefreshHook,
   setUtilityModel,
   unqualifyModelId
 };

package/dist/{archive-AWIJTVQV.js → archive-BC2MTNPV.js}

@@ -5,9 +5,9 @@ import {
   extractArchive,
   isHomeOnlyArchive,
   readManifest
-} from "./chunk-BIEWHAAM.js";
-import "./chunk-2NHRJ3YO.js";
-import "./chunk-CJ26DXZL.js";
+} from "./chunk-76Q6YLJL.js";
+import "./chunk-PDSA3ILI.js";
+import "./chunk-MHFAWJCC.js";
 import "./chunk-K3NQKI34.js";
 export {
   addHistoryToArchive,

package/dist/{auth-2QOOPMBX.js → auth-2IMZ6N5G.js}

@@ -17,11 +17,11 @@ import {
   syncMindProfile,
   updateUserProfile,
   verifyUser
-} from "./chunk-UIM5NHPP.js";
-import "./chunk-N42QMDID.js";
+} from "./chunk-PHR4XQPL.js";
+import "./chunk-5VBXKFPO.js";
 import "./chunk-T2TP6ZC6.js";
-import "./chunk-2NHRJ3YO.js";
-import "./chunk-CJ26DXZL.js";
+import "./chunk-PDSA3ILI.js";
+import "./chunk-MHFAWJCC.js";
 import "./chunk-K3NQKI34.js";
 export {
   approveUser,

package/dist/{chat-XL7CVWVJ.js → chat-O5QCGCUG.js}

@@ -12,7 +12,7 @@ var cmd = subcommands({
   commands: {
     send: {
       description: "Send a message",
-      run: (args) => import("./send-7CIP5GLS.js").then((m) => m.run(args))
+      run: (args) => import("./send-232RAHPX.js").then((m) => m.run(args))
     },
     list: {
       description: "List conversations",
@@ -32,7 +32,7 @@ var cmd = subcommands({
     },
     files: {
       description: "List pending incoming files",
-      run: (args) => import("./files-LAQ3NXQK.js").then((m) => m.run(args))
+      run: (args) => import("./files-J2CKZ6PK.js").then((m) => m.run(args))
     },
     accept: {
       description: "Accept a pending file",

package/dist/{chunk-A6FLW5XD.js → chunk-2AQCEQYN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/config/setup.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-3F7XK5Q7.js → chunk-3XSFMN3H.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   wrapForIsolation
-} from "./chunk-SNW2NPP4.js";
+} from "./chunk-FBV22PFY.js";
 
 // packages/daemon/src/lib/util/exec.ts
 import { execFile as execFileCb, execFileSync, spawn } from "child_process";

package/dist/{chunk-NGXQ2ESO.js → chunk-43PVCF4V.js}

@@ -7,14 +7,14 @@ import {
   modeLabel,
   pollHealth,
   startService
-} from "./chunk-TNZ5XQA4.js";
+} from "./chunk-SGC6CDXB.js";
 import {
   readGlobalConfig
-} from "./chunk-A6FLW5XD.js";
+} from "./chunk-2AQCEQYN.js";
 import {
   voluteHome,
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // src/commands/up.ts
 import { spawn } from "child_process";

package/dist/{chunk-N42QMDID.js → chunk-5VBXKFPO.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-T2TP6ZC6.js";
 import {
   getDb
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 import {
   activity
-} from "./chunk-CJ26DXZL.js";
+} from "./chunk-MHFAWJCC.js";
 
 // packages/daemon/src/lib/events/activity-events.ts
 var subscribers = /* @__PURE__ */ new Set();

package/dist/{chunk-BIEWHAAM.js → chunk-76Q6YLJL.js}

@@ -2,7 +2,7 @@
 import {
   mindDir,
   stateDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/mind/archive.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-5DPRTREW.js → chunk-B7YJUWMM.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   subscribe
-} from "./chunk-N42QMDID.js";
+} from "./chunk-5VBXKFPO.js";
 import {
   logger_default
 } from "./chunk-T2TP6ZC6.js";
 import {
   getDb
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 import {
   channels,
   conversationParticipants,
@@ -15,7 +15,7 @@ import {
   conversations,
   messages,
   users
-} from "./chunk-CJ26DXZL.js";
+} from "./chunk-MHFAWJCC.js";
 
 // packages/daemon/src/lib/events/conversations.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-XLBQYIHH.js → chunk-DNQPHLGM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   stateDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/chat/file-sharing.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-SNW2NPP4.js → chunk-FBV22PFY.js}

@@ -2,7 +2,7 @@
 import {
   getBaseName,
   validateMindName
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/mind/isolation.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-WC635OPK.js → chunk-FRJ73IWR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/update-check.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-PMMHVSCR.js → chunk-HAJHDGBV.js}

@@ -2,7 +2,7 @@
 import {
   stateDir,
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/config/env.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-SZJWC2GA.js → chunk-HEZM5GCV.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   setBridgeConfig
-} from "./chunk-LQ6Z4FXN.js";
+} from "./chunk-S4YO5OWV.js";
 import {
   readEnv,
   sharedEnvPath,
   writeEnv
-} from "./chunk-PMMHVSCR.js";
+} from "./chunk-HAJHDGBV.js";
 
 // packages/daemon/src/lib/template/import-utils.ts
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-PLL2FM7A.js → chunk-JSITYTIL.js}

@@ -2,15 +2,15 @@
 import {
   findBridgeForChannel,
   getBridgeConfig
-} from "./chunk-LQ6Z4FXN.js";
+} from "./chunk-S4YO5OWV.js";
 import {
   publish,
   recordOutbound
-} from "./chunk-TEZRVSSB.js";
+} from "./chunk-XUJR6NZW.js";
 import {
   readEnv,
   sharedEnvPath
-} from "./chunk-PMMHVSCR.js";
+} from "./chunk-HAJHDGBV.js";
 import {
   addMessage,
   findDMConversation,
@@ -18,14 +18,14 @@ import {
   getChannelName,
   getConversation,
   getParticipants
-} from "./chunk-5DPRTREW.js";
+} from "./chunk-B7YJUWMM.js";
 import {
   readVoluteConfig
 } from "./chunk-CU6OFXMM.js";
 import {
   getOrCreateMindUser,
   getUserByUsername
-} from "./chunk-UIM5NHPP.js";
+} from "./chunk-PHR4XQPL.js";
 import {
   logger_default
 } from "./chunk-T2TP6ZC6.js";
@@ -35,7 +35,7 @@ import {
 import {
   mindDir,
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 import {
   __export
 } from "./chunk-K3NQKI34.js";

package/dist/{chunk-CJ26DXZL.js → chunk-MHFAWJCC.js}

@@ -14,6 +14,7 @@ __export(schema_exports, {
   deliveryQueue: () => deliveryQueue,
   messages: () => messages,
   mindHistory: () => mindHistory,
+  mindNotices: () => mindNotices,
   minds: () => minds,
   sessions: () => sessions,
   sharedSkills: () => sharedSkills,
@@ -241,6 +242,20 @@ var messages = sqliteTable(
     index("idx_messages_turn_id").on(table.turn_id)
   ]
 );
+var mindNotices = sqliteTable(
+  "mind_notices",
+  {
+    id: integer("id").primaryKey({ autoIncrement: true }),
+    mind: text("mind").notNull(),
+    session: text("session").notNull(),
+    kind: text("kind").$type().notNull(),
+    reason: text("reason").$type().notNull(),
+    detail: text("detail").notNull(),
+    raw: text("raw"),
+    created_at: text("created_at").notNull().default(sql`(datetime('now'))`)
+  },
+  (table) => [index("idx_mind_notices_mind_session").on(table.mind, table.session)]
+);
 
 export {
   minds,
@@ -258,5 +273,6 @@ export {
   conversationReads,
   channels,
   messages,
+  mindNotices,
   schema_exports
 };

package/dist/{chunk-7AZQFSOV.js → chunk-PC55DGNX.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-T2TP6ZC6.js";
 import {
   mindDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/delivery/delivery-router.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-2NHRJ3YO.js → chunk-PDSA3ILI.js}

@@ -2,7 +2,7 @@
 import {
   minds,
   schema_exports
-} from "./chunk-CJ26DXZL.js";
+} from "./chunk-MHFAWJCC.js";
 
 // packages/daemon/src/lib/db.ts
 import { chmodSync, existsSync } from "fs";
@@ -17,7 +17,7 @@ import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { dirname, resolve } from "path";
 import { fileURLToPath } from "url";
-import { and, eq, isNull } from "drizzle-orm";
+import { and, eq, inArray, isNull } from "drizzle-orm";
 function voluteHome() {
   if (process.env.VOLUTE_HOME) return process.env.VOLUTE_HOME;
   const dir = dirname(fileURLToPath(import.meta.url));
@@ -61,7 +61,7 @@ function rowToEntry(row) {
 }
 async function readRegistry() {
   const db2 = await getDb();
-  const rows = await db2.select().from(minds).where(and(isNull(minds.parent), eq(minds.mind_type, "mind")));
+  const rows = await db2.select().from(minds).where(and(isNull(minds.parent), inArray(minds.mind_type, ["mind", "spirit"])));
   return rows.map(rowToEntry);
 }
 async function readAllMinds() {

package/dist/{chunk-ORNY3MZR.js → chunk-PGX52NFO.js}

@@ -2,7 +2,7 @@
 import {
   readGlobalConfig,
   writeGlobalConfig
-} from "./chunk-A6FLW5XD.js";
+} from "./chunk-2AQCEQYN.js";
 import {
   logger_default
 } from "./chunk-T2TP6ZC6.js";
@@ -11,6 +11,17 @@ import {
 import { complete, getEnvApiKey, getModel, getModels, getProviders } from "@mariozechner/pi-ai";
 import { getOAuthApiKey } from "@mariozechner/pi-ai/oauth";
 var aiLog = logger_default.child("ai-service");
+var providerRefreshHook;
+function setProviderRefreshHook(hook) {
+  providerRefreshHook = hook;
+}
+function fireProviderRefreshHook(providerId) {
+  try {
+    providerRefreshHook?.(providerId);
+  } catch (err) {
+    aiLog.warn(`provider refresh hook failed for ${providerId}`, logger_default.errorData(err));
+  }
+}
 function getAiConfig() {
   const config = readGlobalConfig();
   return config.ai ?? null;
@@ -131,6 +142,7 @@ async function resolveApiKey(providerId) {
       if (result) {
         if (result.newCredentials.access !== providerConfig.oauth.access) {
           saveProviderConfig(providerId, { ...providerConfig, oauth: result.newCredentials });
+          fireProviderRefreshHook(providerId);
         }
         return result.apiKey;
       }
@@ -206,6 +218,8 @@ async function aiComplete(systemPrompt, userMessage, modelId) {
 }
 
 export {
+  setProviderRefreshHook,
+  fireProviderRefreshHook,
   getAiConfig,
   saveProviderConfig,
   removeProviderConfig,

package/dist/{chunk-UIM5NHPP.js → chunk-PHR4XQPL.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   broadcast
-} from "./chunk-N42QMDID.js";
+} from "./chunk-5VBXKFPO.js";
 import {
   getDb
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 import {
   users
-} from "./chunk-CJ26DXZL.js";
+} from "./chunk-MHFAWJCC.js";
 
 // packages/daemon/src/lib/auth.ts
 import { compareSync, hashSync } from "bcryptjs";

package/dist/chunk-PIRL2HAO.js

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+import {
+  readGlobalConfig
+} from "./chunk-2AQCEQYN.js";
+import {
+  logger_default
+} from "./chunk-T2TP6ZC6.js";
+
+// packages/daemon/src/lib/mind/sandbox.ts
+import { execFileSync } from "child_process";
+var slog = logger_default.child("sandbox");
+var sandboxManager = null;
+function isSandboxEnabled() {
+  if (process.env.VOLUTE_SANDBOX === "0") return false;
+  return readGlobalConfig().setup?.isolation === "sandbox";
+}
+function findRipgrep() {
+  if (process.env.VOLUTE_RIPGREP_PATH) {
+    try {
+      execFileSync(process.env.VOLUTE_RIPGREP_PATH, ["--version"], {
+        encoding: "utf-8",
+        timeout: 5e3
+      });
+      return process.env.VOLUTE_RIPGREP_PATH;
+    } catch {
+      slog.warn(
+        `VOLUTE_RIPGREP_PATH set to ${process.env.VOLUTE_RIPGREP_PATH} but binary not executable \u2014 falling back to system PATH`
+      );
+    }
+  }
+  try {
+    return execFileSync("which", ["rg"], { encoding: "utf-8" }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function initSandbox() {
+  if (!isSandboxEnabled()) return;
+  try {
+    const { SandboxManager } = await import("@anthropic-ai/sandbox-runtime");
+    const rgPath = findRipgrep();
+    const ripgrepConfig = rgPath ? { command: rgPath } : void 0;
+    const { errors, warnings } = SandboxManager.checkDependencies(ripgrepConfig);
+    if (warnings.length > 0) {
+      slog.warn(`sandbox dependency warnings: ${warnings.join(", ")}`);
+    }
+    if (errors.length > 0) {
+      if (process.platform === "darwin") {
+        slog.warn(`sandbox dependency issues (non-fatal on macOS): ${errors.join(", ")}`);
+      } else {
+        slog.error(
+          `sandbox dependencies missing \u2014 minds will run without sandbox isolation: ${errors.join(", ")}`
+        );
+        return;
+      }
+    }
+    const config = {
+      filesystem: {
+        denyRead: [],
+        allowWrite: [],
+        denyWrite: []
+      },
+      ...ripgrepConfig ? { ripgrep: ripgrepConfig } : {}
+    };
+    await SandboxManager.initialize(config);
+    sandboxManager = SandboxManager;
+  } catch (err) {
+    slog.error(
+      "sandbox runtime not available \u2014 minds will run without sandbox isolation",
+      logger_default.errorData(err)
+    );
+  }
+}
+async function buildSandboxReadConfig(_mindName, mindDir) {
+  const userHome = process.env.HOME || "";
+  const denyRead = [];
+  const allowRead = [mindDir];
+  if (userHome) {
+    denyRead.push(userHome);
+  } else {
+    slog.warn("$HOME is not set \u2014 sandbox read restrictions will be limited");
+  }
+  if (process.env.VOLUTE_ISOLATION === "user") {
+    const usersDir = process.platform === "darwin" ? "/Users" : "/home";
+    if (!denyRead.includes(usersDir)) {
+      denyRead.push(usersDir);
+    }
+  }
+  return { denyRead, allowRead };
+}
+function shellEscape(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+async function wrapForSandbox(cmd, args, mindDir, mindName, allowWrite) {
+  if (!sandboxManager) return [cmd, args];
+  const { denyRead, allowRead } = await buildSandboxReadConfig(mindName, mindDir);
+  const customConfig = {
+    filesystem: {
+      denyRead,
+      allowRead,
+      allowWrite: allowWrite ?? [mindDir],
+      denyWrite: []
+    }
+  };
+  try {
+    const shellCmd = [cmd, ...args].map(shellEscape).join(" ");
+    const wrapped = await sandboxManager.wrapWithSandbox(shellCmd, void 0, customConfig);
+    return ["bash", ["-c", wrapped]];
+  } catch (err) {
+    slog.error(
+      `failed to sandbox mind ${mindName} \u2014 running without isolation`,
+      logger_default.errorData(err)
+    );
+    return [cmd, args];
+  }
+}
+
+export {
+  isSandboxEnabled,
+  initSandbox,
+  buildSandboxReadConfig,
+  shellEscape,
+  wrapForSandbox
+};

package/dist/{chunk-JOJT34M2.js → chunk-PZTVQL3J.js}

@@ -3,10 +3,10 @@ import {
   LAUNCHD_PLIST_LABEL,
   LAUNCHD_PLIST_PATH,
   USER_SYSTEMD_UNIT
-} from "./chunk-TNZ5XQA4.js";
+} from "./chunk-SGC6CDXB.js";
 import {
   resolveVoluteBin
-} from "./chunk-3F7XK5Q7.js";
+} from "./chunk-3XSFMN3H.js";
 
 // packages/daemon/src/lib/config/service-install.ts
 import { execFile } from "child_process";

package/dist/{chunk-GVVVMZ4J.js → chunk-RMZSICLS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   publish
-} from "./chunk-N42QMDID.js";
+} from "./chunk-5VBXKFPO.js";
 import {
   logger_default
 } from "./chunk-T2TP6ZC6.js";

package/dist/{chunk-LQ6Z4FXN.js → chunk-S4YO5OWV.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-T2TP6ZC6.js";
 import {
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/bridges/bridges.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-TNZ5XQA4.js → chunk-SGC6CDXB.js}

@@ -2,10 +2,10 @@
 import {
   exec,
   execInherit
-} from "./chunk-3F7XK5Q7.js";
+} from "./chunk-3XSFMN3H.js";
 import {
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // packages/daemon/src/lib/config/service-mode.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-LN67VPZJ.js → chunk-SOPMVTTW.js}

@@ -8,10 +8,10 @@ import {
   pollHealthDown,
   readDaemonConfig,
   stopService
-} from "./chunk-TNZ5XQA4.js";
+} from "./chunk-SGC6CDXB.js";
 import {
   voluteSystemDir
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 
 // src/commands/down.ts
 import { existsSync, readFileSync, unlinkSync } from "fs";

package/dist/{chunk-VUM2K6EN.js → chunk-T26YLQPU.js}

@@ -2,11 +2,11 @@
 import {
   exec,
   gitExec
-} from "./chunk-3F7XK5Q7.js";
+} from "./chunk-3XSFMN3H.js";
 import {
   readGlobalConfig,
   writeGlobalConfig
-} from "./chunk-A6FLW5XD.js";
+} from "./chunk-2AQCEQYN.js";
 import {
   logger_default
 } from "./chunk-T2TP6ZC6.js";
@@ -15,10 +15,10 @@ import {
   mindDir,
   readRegistry,
   voluteHome
-} from "./chunk-2NHRJ3YO.js";
+} from "./chunk-PDSA3ILI.js";
 import {
   sharedSkills
-} from "./chunk-CJ26DXZL.js";
+} from "./chunk-MHFAWJCC.js";
 
 // packages/daemon/src/lib/skills.ts
 import { createHash } from "crypto";
@@ -46,7 +46,7 @@ async function initDefaultSkills() {
   const config = readGlobalConfig();
   let extensionSkills = [];
   try {
-    const { getExtensionStandardSkills } = await import("./extensions-P477XR46.js");
+    const { getExtensionStandardSkills } = await import("./extensions-VN5SEVRP.js");
     extensionSkills = getExtensionStandardSkills();
   } catch (err) {
     logger_default.warn("failed to load extension standard skills during init", logger_default.errorData(err));