volute 0.40.2 → 0.41.1

package/dist/{accept-IVHOHXQS.js → accept-7YVHZKRD.js}

@@ -4,12 +4,12 @@ import {
 } from "./chunk-BTY4WNFE.js";
 import {
   daemonFetch
-} from "./chunk-ZX7EAV5J.js";
+} from "./chunk-IFNSAOA4.js";
 import {
   command
 } from "./chunk-TXSA4Q3V.js";
 import "./chunk-O7IGP7ZW.js";
-import "./chunk-LMMQX4CK.js";
+import "./chunk-K3NQKI34.js";
 
 // packages/cli/src/commands/chat/accept.ts
 var cmd = command({

package/dist/{activity-events-DS4QRWBY.js → activity-events-KFKVRZE3.js}

@@ -3,11 +3,11 @@ import {
   broadcast,
   publish,
   subscribe
-} from "./chunk-QYI65HCL.js";
+} from "./chunk-K547QOCM.js";
 import "./chunk-T2TP6ZC6.js";
-import "./chunk-B4WPXYPI.js";
-import "./chunk-2HZRJ35V.js";
-import "./chunk-LMMQX4CK.js";
+import "./chunk-IUZ3EV2D.js";
+import "./chunk-MHFAWJCC.js";
+import "./chunk-K3NQKI34.js";
 export {
   broadcast,
   publish,

package/dist/{ai-service-EVLKMAJD.js → ai-service-XCLE3MQP.js}

@@ -19,12 +19,12 @@ import {
   setProviderRefreshHook,
   setUtilityModel,
   unqualifyModelId
-} from "./chunk-ZXPWTH4I.js";
-import "./chunk-DNU6XLE2.js";
+} from "./chunk-IJCZAYGT.js";
+import "./chunk-MA7MYEOK.js";
 import "./chunk-T2TP6ZC6.js";
-import "./chunk-B4WPXYPI.js";
-import "./chunk-2HZRJ35V.js";
-import "./chunk-LMMQX4CK.js";
+import "./chunk-IUZ3EV2D.js";
+import "./chunk-MHFAWJCC.js";
+import "./chunk-K3NQKI34.js";
 export {
   aiComplete,
   aiCompleteUtility,

package/dist/{api-client-NFM6GX2N.js → api-client-LC5YRA32.js}

@@ -3,7 +3,7 @@ import {
   getClient,
   urlOf
 } from "./chunk-LOPXTW6H.js";
-import "./chunk-LMMQX4CK.js";
+import "./chunk-K3NQKI34.js";
 export {
   getClient,
   urlOf

package/dist/{archive-UDHFZN4G.js → archive-4PPYF7LL.js}

@@ -5,10 +5,10 @@ import {
   extractArchive,
   isHomeOnlyArchive,
   readManifest
-} from "./chunk-I57LLNAQ.js";
-import "./chunk-B4WPXYPI.js";
-import "./chunk-2HZRJ35V.js";
-import "./chunk-LMMQX4CK.js";
+} from "./chunk-OEJFZHZZ.js";
+import "./chunk-IUZ3EV2D.js";
+import "./chunk-MHFAWJCC.js";
+import "./chunk-K3NQKI34.js";
 export {
   addHistoryToArchive,
   createExportArchive,

package/dist/{auth-X6ZITZ7D.js → auth-EAASQPTN.js}

@@ -17,12 +17,12 @@ import {
   syncMindProfile,
   updateUserProfile,
   verifyUser
-} from "./chunk-E25SO3QW.js";
-import "./chunk-QYI65HCL.js";
+} from "./chunk-5QG36RV7.js";
+import "./chunk-K547QOCM.js";
 import "./chunk-T2TP6ZC6.js";
-import "./chunk-B4WPXYPI.js";
-import "./chunk-2HZRJ35V.js";
-import "./chunk-LMMQX4CK.js";
+import "./chunk-IUZ3EV2D.js";
+import "./chunk-MHFAWJCC.js";
+import "./chunk-K3NQKI34.js";
 export {
   approveUser,
   changePassword,

package/dist/{bridge-MSZC4HUT.js → bridge-WPYSOQKR.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   daemonFetch
-} from "./chunk-ZX7EAV5J.js";
+} from "./chunk-IFNSAOA4.js";
 import {
   command,
   subcommands
 } from "./chunk-TXSA4Q3V.js";
 import "./chunk-O7IGP7ZW.js";
-import "./chunk-LMMQX4CK.js";
+import "./chunk-K3NQKI34.js";
 
 // packages/cli/src/commands/chat/bridge.ts
 var bridgeAddCmd = command({

package/dist/{chat-F2EEN76G.js → chat-7DOENBY2.js}

@@ -3,7 +3,7 @@ import {
   subcommands
 } from "./chunk-TXSA4Q3V.js";
 import "./chunk-O7IGP7ZW.js";
-import "./chunk-LMMQX4CK.js";
+import "./chunk-K3NQKI34.js";
 
 // packages/cli/src/commands/chat.ts
 var cmd = subcommands({
@@ -12,35 +12,35 @@ var cmd = subcommands({
   commands: {
     send: {
       description: "Send a message",
-      run: (args) => import("./send-WO3CVG73.js").then((m) => m.run(args))
+      run: (args) => import("./send-KQECN2EL.js").then((m) => m.run(args))
     },
     list: {
       description: "List conversations",
-      run: (args) => import("./list-BYCEDASJ.js").then((m) => m.run(args))
+      run: (args) => import("./list-XJB5WII6.js").then((m) => m.run(args))
     },
     read: {
       description: "Read conversation messages",
-      run: (args) => import("./read-OOINVR2H.js").then((m) => m.run(args))
+      run: (args) => import("./read-JLR4NQXU.js").then((m) => m.run(args))
     },
     create: {
       description: "Create a conversation",
-      run: (args) => import("./create-ZMTGINV3.js").then((m) => m.run(args))
+      run: (args) => import("./create-CJ2SR4EU.js").then((m) => m.run(args))
     },
     bridge: {
       description: "Manage platform bridges",
-      run: (args) => import("./bridge-MSZC4HUT.js").then((m) => m.run(args))
+      run: (args) => import("./bridge-WPYSOQKR.js").then((m) => m.run(args))
     },
     files: {
       description: "List pending incoming files",
-      run: (args) => import("./files-WNNVJWJB.js").then((m) => m.run(args))
+      run: (args) => import("./files-K2MEMV3W.js").then((m) => m.run(args))
     },
     accept: {
       description: "Accept a pending file",
-      run: (args) => import("./accept-IVHOHXQS.js").then((m) => m.run(args))
+      run: (args) => import("./accept-7YVHZKRD.js").then((m) => m.run(args))
     },
     reject: {
       description: "Reject a pending file",
-      run: (args) => import("./reject-ZBWP62X5.js").then((m) => m.run(args))
+      run: (args) => import("./reject-N2D4CZND.js").then((m) => m.run(args))
     }
   },
   footer: "Use --mind <name> or VOLUTE_MIND to identify the mind."

package/dist/{chunk-E25SO3QW.js → chunk-5QG36RV7.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   broadcast
-} from "./chunk-QYI65HCL.js";
+} from "./chunk-K547QOCM.js";
 import {
   getDb
-} from "./chunk-B4WPXYPI.js";
+} from "./chunk-IUZ3EV2D.js";
 import {
   users
-} from "./chunk-2HZRJ35V.js";
+} from "./chunk-MHFAWJCC.js";
 
 // packages/daemon/src/lib/auth.ts
 import { compareSync, hashSync } from "bcryptjs";

package/dist/{chunk-NERYUSER.js → chunk-62ICA2FF.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-T2TP6ZC6.js";
 import {
   mindDir
-} from "./chunk-B4WPXYPI.js";
+} from "./chunk-IUZ3EV2D.js";
 
 // packages/daemon/src/lib/delivery/delivery-router.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-KMHC36CA.js → chunk-763WUVJQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readGlobalConfig
-} from "./chunk-DNU6XLE2.js";
+} from "./chunk-MA7MYEOK.js";
 import {
   logger_default
 } from "./chunk-T2TP6ZC6.js";
@@ -10,10 +10,22 @@ import {
 import { execFileSync } from "child_process";
 var slog = logger_default.child("sandbox");
 var sandboxManager = null;
+var SandboxUnavailableError = class extends Error {
+  constructor(reason, cause) {
+    super(
+      `${reason} \u2014 refusing to run unsandboxed. Fix the sandbox runtime, or set VOLUTE_SANDBOX_OPTIONAL=1 to allow running without isolation.`,
+      cause ? { cause } : void 0
+    );
+    this.name = "SandboxUnavailableError";
+  }
+};
 function isSandboxEnabled() {
   if (process.env.VOLUTE_SANDBOX === "0") return false;
   return readGlobalConfig().setup?.isolation === "sandbox";
 }
+function isSandboxOptional() {
+  return process.env.VOLUTE_SANDBOX_OPTIONAL === "1";
+}
 function findRipgrep() {
   if (process.env.VOLUTE_RIPGREP_PATH) {
     try {
@@ -48,10 +60,7 @@ async function initSandbox() {
       if (process.platform === "darwin") {
         slog.warn(`sandbox dependency issues (non-fatal on macOS): ${errors.join(", ")}`);
       } else {
-        slog.error(
-          `sandbox dependencies missing \u2014 minds will run without sandbox isolation: ${errors.join(", ")}`
-        );
-        return;
+        throw new SandboxUnavailableError(`sandbox dependencies missing: ${errors.join(", ")}`);
       }
     }
     const config = {
@@ -65,10 +74,24 @@ async function initSandbox() {
     await SandboxManager.initialize(config);
     sandboxManager = SandboxManager;
   } catch (err) {
-    slog.error(
-      "sandbox runtime not available \u2014 minds will run without sandbox isolation",
-      logger_default.errorData(err)
-    );
+    if (err instanceof SandboxUnavailableError) {
+      if (isSandboxOptional()) {
+        slog.error(
+          "sandbox unavailable but VOLUTE_SANDBOX_OPTIONAL=1 \u2014 minds will run WITHOUT isolation",
+          logger_default.errorData(err)
+        );
+        return;
+      }
+      throw err;
+    }
+    if (isSandboxOptional()) {
+      slog.error(
+        "sandbox runtime not available but VOLUTE_SANDBOX_OPTIONAL=1 \u2014 minds will run WITHOUT isolation",
+        logger_default.errorData(err)
+      );
+      return;
+    }
+    throw new SandboxUnavailableError("sandbox runtime not available", err);
   }
 }
 async function buildSandboxReadConfig(_mindName, mindDir) {
@@ -92,7 +115,12 @@ function shellEscape(s) {
   return `'${s.replace(/'/g, "'\\''")}'`;
 }
 async function wrapForSandbox(cmd, args, mindDir, mindName, allowWrite) {
-  if (!sandboxManager) return [cmd, args];
+  if (!sandboxManager) {
+    if (isSandboxEnabled() && !isSandboxOptional()) {
+      throw new SandboxUnavailableError(`cannot sandbox mind ${mindName}`);
+    }
+    return [cmd, args];
+  }
   const { denyRead, allowRead } = await buildSandboxReadConfig(mindName, mindDir);
   const customConfig = {
     filesystem: {
@@ -107,6 +135,9 @@ async function wrapForSandbox(cmd, args, mindDir, mindName, allowWrite) {
     const wrapped = await sandboxManager.wrapWithSandbox(shellCmd, void 0, customConfig);
     return ["bash", ["-c", wrapped]];
   } catch (err) {
+    if (isSandboxEnabled() && !isSandboxOptional()) {
+      throw new SandboxUnavailableError(`failed to sandbox mind ${mindName}`, err);
+    }
     slog.error(
       `failed to sandbox mind ${mindName} \u2014 running without isolation`,
       logger_default.errorData(err)
@@ -116,7 +147,9 @@ async function wrapForSandbox(cmd, args, mindDir, mindName, allowWrite) {
 }
 
 export {
+  SandboxUnavailableError,
   isSandboxEnabled,
+  isSandboxOptional,
   initSandbox,
   buildSandboxReadConfig,
   shellEscape,

package/dist/{chunk-ITH5ZLZJ.js → chunk-BLOAJLGI.js}

@@ -2,7 +2,7 @@
 import {
   stateDir,
   voluteSystemDir
-} from "./chunk-B4WPXYPI.js";
+} from "./chunk-IUZ3EV2D.js";
 
 // packages/daemon/src/lib/config/env.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-4UMXOMZ6.js → chunk-CGPESELY.js}

@@ -2,10 +2,10 @@
 import {
   exec,
   execInherit
-} from "./chunk-AEAZRTEV.js";
+} from "./chunk-GN52E2DP.js";
 import {
   voluteSystemDir
-} from "./chunk-B4WPXYPI.js";
+} from "./chunk-IUZ3EV2D.js";
 
 // packages/daemon/src/lib/config/service-mode.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-MNUXL4XN.js → chunk-E7XWFDZL.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   voluteSystemDir
-} from "./chunk-B4WPXYPI.js";
+} from "./chunk-IUZ3EV2D.js";
 
 // packages/daemon/src/lib/update-check.ts
 import { execFile as execFileCb, execFileSync } from "child_process";

package/dist/{chunk-PEKG3GNZ.js → chunk-EKLRS2SX.js}

@@ -7,14 +7,14 @@ import {
   modeLabel,
   pollHealth,
   startService
-} from "./chunk-4UMXOMZ6.js";
+} from "./chunk-CGPESELY.js";
 import {
   readGlobalConfig
-} from "./chunk-DNU6XLE2.js";
+} from "./chunk-MA7MYEOK.js";
 import {
   voluteHome,
   voluteSystemDir
-} from "./chunk-B4WPXYPI.js";
+} from "./chunk-IUZ3EV2D.js";
 
 // src/commands/up.ts
 import { spawn } from "child_process";