@nathapp/nax-agent 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to `@nathapp/nax-agent` are recorded here. The format follow
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). While the version is `0.x`, a minor
 release may change the public API.
 
+## [0.3.0] - 2026-10-06
+
+The backend seam for S4. Breaking: `createAgentSession` takes a `SessionBackend`. nax behaviour unchanged.
+
+### Changed
+
+- **Breaking:** `CreateAgentSessionOptions.backend` is a `SessionBackend` (was `"native"`). `model`, `credentials`, `catalogOverrides`, `loopHandlers`, `hostPorts`, `bashApproval` and `allowUnsandboxed` move into `nativeBackend({ ... })`. A native-only key at the top level is `AGENT_SESSION_INVALID_OPTIONS`.
+- `resumeAgentSession` refuses a document written by another backend kind (`AGENT_SESSION_BACKEND_MISMATCH`); documents without a `backend` field are native.
+
+### Added
+
+- `SessionBackend`, `BackendOpenContext`, `OpenedBackend`, `BackendInfo`, `TurnContribution`, `SessionAskPort`, `ApprovalRequest`, and `nativeBackend` with `NativeBackendOptions`. `AgentSession.backend` reports the backend's kind and capabilities.
+- The `ask` profile: every Write, Edit, Delete, GitCommit and Bash is approved through `answer()`; it requires `bashApproval: "gated"` and the sandbox floor of `full`.
+- `ApprovalDecidedBy` gains `"profile"`; `usage` and `turn_end` gain `costSource` (`computed` | `reported` | `unpriced`; `CostSource`); `TurnResult` gains `costSource`.
+- Error codes `AGENT_SESSION_BACKEND_UNAVAILABLE`, `AGENT_SESSION_AUTH_REQUIRED`, `AGENT_SESSION_CAPABILITY_UNSUPPORTED`, `AGENT_SESSION_BACKEND_MISMATCH`.
+- `TranscriptDoc.backend` and `TranscriptDoc.acp` (`TranscriptAcpRecord`), optional and additive (schemaVersion stays 1).
+- `TranscriptAcpRecord.costUsd`: the ACP agent's cumulative cost reading at the session's last priced turn, so a resumed ACP session prices its next turn from it.
+- Backend kit on `.`: `redactSecrets`, `capStrings`, `killProcessGroup`, `isProcessAlive`, `TOOL_CALL_INPUT_BYTES`, `TOOL_RESULT_PREVIEW_BYTES`, `createStderrTail` (`StderrTail`), and `NaxError`, the base class of `AgentSessionError`, so a backend can throw codes outside `AgentSessionErrorCode` (S4 spec §5.7).
+- `getLogger` on `.`: the logger the host installed with `setAgentLogger`, or a silent no-op, so a backend can log through the host's logger.
+- `SessionAskPort.askQuestion(text, { signal })`: an extra abort source combined with the turn signal, as `ApprovalRequest.signal` is for approvals, so a backend can settle a question when its own request scope ends (S4 spec §6.3 step 5).
+
+## [0.2.0] - 2026-10-05
+
+The conversational session API for embedders. nax behaviour unchanged.
+
+### Added
+
+- `createAgentSession` and `resumeAgentSession`: a multi-turn session with streamed `SessionEvent`s, embedder tools (`EmbedderTool`, approval `"never" | "always"`), approvals and questions answered with `session.answer()`, `cancel()`, `close()`, and the `none` / `read` / `full` tool profiles. Types: `AgentSession`, `CreateAgentSessionOptions`, `AgentSessionHostPorts`, `AgentSessionProfile`, `EmbedderToolContext`, `EmbedderToolResult`, `SessionEvent`, `SessionEventBase`, `SessionEventBody`, `TurnEndStatus`, `ApprovalDecidedBy`, `AnswerReply`, `AnswerStatus`. Errors: `AgentSessionError` with `AgentSessionErrorCode` (`AGENT_SESSION_*`).
+- `resumeAgentSession` reopens a stored session after a restart; a turn the dead process left running is reported as `lastTurn.status: "interrupted"`.
+- Facade sessions retry a transient provider fault after text has streamed (3 attempts) and emit `stream_reset` for the voided deltas.
+- The `TranscriptStore` port: `TranscriptDoc`, `TurnMarker`, `createFileTranscriptStore`, `createMemoryTranscriptStore` (`MemoryTranscriptStore`). `OpenSessionOpts` gains `transcriptStore`, `retainOnClose` and `systemPrompt`.
+- Native model calls stream. `SendTurnOpts.onTurnEvent` receives `TurnEvent`s (`TurnEventSink`): text and thinking deltas, `stream_reset`, `tool_call`, `tool_result`, per-call `usage` and `compaction`. Payloads are redacted and byte-capped.
+- Per-session credential sources (`CredentialSource`: `memory`, `exec`) and adapter-owned clients (`NativeSessionAdapterOptions`); `AuthStamp.source` may be `memory`.
+- The loop-handler and loop-event types are public on `.`: `LoopHandlerSet`, `LoopHandlerEntry`, `LoopHandlerContext`, `LoopEvent`, `LoopEventMap`, `PayloadOf`, `PatchOf`, `ExternalHandlerOf`, `CompleteCallOptions` and the `Before*` / `After*` / `TransformContext*` payload, patch and outcome types. So are the command-interceptor types `CommandInterceptor`, `InterceptRequest`, `InterceptResult`, `ShellInterceptRequest` and `ShellInterceptResult`.
+- The `OwnedPathsPolicy` host port with `EMPTY_OWNED_PATHS_POLICY` and `OwnedBashCandidate`: which paths the host owns the writes to, and how its refusals read. nax supplies its own policy; an embedder that injects nothing gets the empty policy.
+
+### Changed
+
+- `resolveWithin` gains a required third parameter (`ownedPaths`). `SandboxPolicyInput` gains `ownedPaths` (required) and `projectStateDir` (optional), and `buildSandboxPolicy` follows.
+- Three `ProtectedPathsPolicy` fields (`projectStateDir`, `credentialDir`, `trustStoreFile`) become optional; the sandbox skips the absent ones.
+- `Read`, `Glob` and `Grep` refuse a symlink-resolved host credential directory or trust-store file when the workdir contains it, regardless of grant.
+- `./internal` (outside semver): the module-scope native session maps are replaced by a per-adapter `NativeSessionState`.
+
 ## [0.1.0] - 2026-10-03
 
 First published version. Extracted from nax, where it was the native agent.

package/README.md

@@ -2,7 +2,7 @@
 
 nax's native coding agent as a package: the session contract, the native session adapter and its turn loop over `@nathapp/nax-ai`, the tool set, permission resolution, the OS sandbox, command-safety and cost accounting.
 
-> **Pre-1.0, not yet published.** `0.1.0` is the first planned version. Until `1.0` the API of `.` may change in any minor release. Pin an exact version.
+> **Pre-1.0.** Until `1.0` the API of `.` may change in any minor release. Pin an exact version.
 
 ## Install
 
@@ -37,9 +37,63 @@ Three pieces of host knowledge are passed in as data or functions, because the p
 - **`ProtectedPathsPolicy`** names the paths you own and want kept away from the agent: git pathspecs the Git tool excludes from its default view, gitignore patterns `GitCommit` refuses to stage, the project state directory, the credential directory and the trust-store file the sandbox protects. If you do not supply it, the Git tool excludes nothing from its default view, and `GitCommit` fails closed: it refuses every path and stages nothing until the policy supplies a non-empty `gitIgnorePatterns` (an empty list refuses the same way). Supply it whenever the agent works in a directory that holds files you own. Building a sandboxed session requires it.
 - **`commandInterceptor`** may rewrite a command before it runs (for example to prefix a wrapper binary). Rewrites are validated: an argv rewrite may only prefix the original argv with the provider's own binary, and a shell rewrite goes through the same narrowing. If you do not supply one, commands run unchanged. An interceptor that throws, or returns a rewrite that fails validation, is treated as a decline, and the original command runs.
 
+## Conversational sessions
+
+`createAgentSession` gives an embedder (for example a long-running Node service) a multi-turn chat with a person in the loop. Events stream, tools come from the embedder, history lives in a store the embedder supplies, and a turn can be cancelled or answered with an approval.
+
+```ts
+import { createAgentSession, createFileTranscriptStore, type EmbedderTool, nativeBackend } from "@nathapp/nax-agent";
+
+const lookupOrder: EmbedderTool = {
+  name: "lookup_order",
+  description: "Look up an order by id.",
+  inputSchema: { type: "object", properties: { id: { type: "number" } }, required: ["id"] },
+  approval: "always", // ask the person before every run
+  async run(input, { signal }) {
+    return { content: JSON.stringify(await orders.get(input, { signal })) };
+  },
+};
+
+const session = await createAgentSession({
+  backend: nativeBackend({ model: "anthropic/claude-sonnet-5-5" }),
+  profile: "ask",
+  workdir: "/abs/project",
+  tools: [lookupOrder],
+  transcriptStore: createFileTranscriptStore("/abs/state/sessions"),
+});
+
+for await (const event of session.send("Where is order 42?")) {
+  if (event.type === "text_delta") process.stdout.write(event.text);
+  if (event.type === "approval_requested") showApproval(event); // later: session.answer(event.requestId, { decision: "allow" })
+  if (event.type === "turn_end") console.log(event.status, event.costUsd);
+}
+await session.close();
+```
+
+Profiles set what a session may do:
+
+| Profile | Side effects |
+|:--------|:-------------|
+| `none` | no side effects; |
+| `read` | read-only; |
+| `ask` | every Write, Edit, Delete, GitCommit and Bash is put to `answer()`; |
+| `full` | no prompts; `bashApproval` and the sandbox floor apply. |
+
+`createAgentSession` takes a `SessionBackend`. `nativeBackend(opts)` takes `model`, `credentials`, `catalogOverrides`, `loopHandlers`, `hostPorts`, `bashApproval` and `allowUnsandboxed`. The ACP backend ships in `@nathapp/nax-agent-acp`.
+
+`usage.costSource` is `computed` (native), `reported` or `unpriced`; never sum `unpriced` rows as cost.
+
+- **One turn at a time.** `send()` claims the session's turn slot at once. A second `send()` while a turn runs throws `AGENT_SESSION_BUSY`. The returned iterable is single-use, and the turn starts on its first `next()`. Breaking out of the loop cancels the turn.
+- **Events.** `turn_start`, `text_delta`, `thinking_delta`, `stream_reset`, `tool_call`, `tool_result`, `approval_requested`, `approval_resolved`, `question`, `usage`, `compaction` and `turn_end`. Sessions do not compact, so `compaction` is not emitted and a conversation that outgrows the model's context window ends `errored`. Each carries `sessionId`, `turnId`, `at` and your `metadata`. `turn_end` is always last, and a failed turn arrives as `turn_end`, never as a throw.
+- **Deltas are provisional.** `stream_reset` means the deltas of that round so far are void: the provider call was retried after a transient fault (up to 3 attempts; a rate-limit retry waits the provider's `retryAfter` silently, and `cancel()` ends the wait). `turn_end.output` and the stored transcript are authoritative. While your consumer lags, adjacent deltas are merged; control events are never merged or dropped.
+- **Approvals and questions.** Answer them with `session.answer(requestId, { decision: "allow" | "deny" })` or `{ text }`. An unanswered one is denied after `approvalTimeoutMs` (default 600000, range 30000..3600000). `answer` returns `"accepted"`, `"expired"`, `"cancelled"` or `"unknown"`.
+- **Credentials.** A session's `credentials` (`memory` or `exec`) and `catalogOverrides` give it its own client. Without them it uses the process-wide `configureCredentials` slot.
+- **History and restarts.** The store holds one document per session, saved at the end of every turn. `close()` keeps it. After a restart, `resumeAgentSession(sessionId, options)` reopens it with the same options you created it with; pass `instructions` and `tools` again, since they are not stored. If the process died mid-turn, `session.lastTurn` is `{ turnId, status: "interrupted" }`, and that turn's message is not in history. A resume with a different model throws `AGENT_SESSION_MODEL_MISMATCH`; a different reasoning effort (`[high]`) is the same model. Resuming with a different backend kind throws `AGENT_SESSION_BACKEND_MISMATCH`; a stored document with no `backend` field is native. Do not open one session id twice at once: the store has no lock.
+- **Errors.** Every error is an `AgentSessionError` with a code `AGENT_SESSION_*`: `INVALID_OPTIONS`, `EXISTS`, `BUSY`, `CLOSED`, `INVALID_ANSWER`, `NOT_FOUND`, `SCHEMA_UNSUPPORTED`, `MODEL_MISMATCH`, `SANDBOX_UNAVAILABLE`, `TOOL_NAME_RESERVED`, `BACKEND_UNAVAILABLE`, `AUTH_REQUIRED`, `CAPABILITY_UNSUPPORTED` or `BACKEND_MISMATCH`. A stored document that cannot be read is a `NaxError` with `TRANSCRIPT_CORRUPT`.
+
 ## Status and roadmap
 
-The embedder-facing session API is still being designed, so `0.x` may reshape `.` with a minor bump. See [`CHANGELOG.md`](CHANGELOG.md).
+`0.x` may reshape `.` with a minor bump. `@nathapp/nax-agent-acp` provides an ACP backend for the same API (0.3.0). See [`CHANGELOG.md`](CHANGELOG.md).
 
 Maintainers: see the [release procedure](https://github.com/nathapp-io/nax/blob/main/packages/nax-agent/RELEASING.md)
 for the manual 0.1.0 publish and OTP step, trusted-publisher setup and subsequent tagged releases.

package/dist/coding-tools/coding-tool-sandbox.d.ts

@@ -2,6 +2,7 @@ import { homedir } from "node:os";
 import type { SandboxConfig } from "#src/config/schemas-sandbox";
 import { type CommandLauncher, defaultTempRoots, listCredentialFiles, listGitGuardFiles, listNaxEntries, probeSandboxOnce, resolveGitLayout, runTempRoots, sandboxBackendFor, strayCommonDirTripwire } from "#src/sandbox/index";
 import type { ProtectedPathsPolicy } from "#src/tools/index";
+import type { OwnedPathsPolicy } from "#src/tools/owned-paths";
 export declare const _sessionSandboxDeps: {
     backendFor: typeof sandboxBackendFor;
     probe: typeof probeSandboxOnce;
@@ -32,6 +33,8 @@ export declare function resolveSessionSandbox(args: {
     readonly runTmpRoot?: string;
     /** Host-owned paths the policy denies (S1 spec port 6); nax passes `naxProtectedPaths()`. */
     readonly protectedPaths: ProtectedPathsPolicy;
+    /** S3-2: host-owned path rules; nax passes naxOwnedPathsPolicy, an embedder EMPTY_OWNED_PATHS_POLICY. */
+    readonly ownedPaths: OwnedPathsPolicy;
 }): Promise<CommandLauncher>;
 /** The compile-time policy refusal for `raw` (Task 8), or undefined. */
 export declare function rawRefusalFor(launcher: CommandLauncher | undefined): string | undefined;

package/dist/coding-tools/coding-tool-sandbox.js

@@ -81,7 +81,9 @@ export async function resolveSessionSandbox(args) {
         });
     }
     const git = await _sessionSandboxDeps.gitLayout(args.root);
-    const credentialFiles = await _sessionSandboxDeps.credentialFiles(args.protectedPaths.credentialDir);
+    // S3 spec 6.2: an absent credentialDir denies nothing -- the lookup itself is skipped.
+    const credentialDir = args.protectedPaths.credentialDir;
+    const credentialFiles = credentialDir === undefined ? [] : await _sessionSandboxDeps.credentialFiles(credentialDir);
     const approvalsFile = args.outputDir !== undefined ? approvalsPath(args.outputDir) : undefined;
     // Before the policy: the confined roots include the session temp dir itself.
     const { tempRoots, confined } = await sessionTempRoots({
@@ -95,12 +97,21 @@ export async function resolveSessionSandbox(args) {
         git,
         // Per build, like the .nax entries: a worktree added mid-run gets its denies too.
         gitGuardFiles: await _sessionSandboxDeps.gitGuardFiles(git),
-        naxEntries: await _sessionSandboxDeps.naxEntries(root, args.protectedPaths.projectStateDir),
+        // S3 spec 6.2: no project-state dir, no lookup and no project-state denies.
+        naxEntries: args.protectedPaths.projectStateDir === undefined
+            ? []
+            : await _sessionSandboxDeps.naxEntries(root, args.protectedPaths.projectStateDir),
         credentialFiles,
+        ...(args.protectedPaths.projectStateDir !== undefined
+            ? { projectStateDir: args.protectedPaths.projectStateDir }
+            : {}),
+        ownedPaths: args.ownedPaths,
         ...(approvalsFile !== undefined ? { approvalsFile } : {}),
         // US-006: a command inside the sandbox must not be able to rewrite the
         // trust store that decides whether repository code runs.
-        trustStoreFile: args.protectedPaths.trustStoreFile,
+        ...(args.protectedPaths.trustStoreFile !== undefined
+            ? { trustStoreFile: args.protectedPaths.trustStoreFile }
+            : {}),
         home: _sessionSandboxDeps.homedir(),
         tempRoots,
         // #2301: the RESOLVED confinement, not `config.filesystem.allowSharedTmp`.

package/dist/coding-tools/coding-tool-support.d.ts

@@ -15,6 +15,7 @@ import type { QualityCommandSpec } from "#src/internal/command-spec/index";
 import type { AskResolver } from "#src/permissions/index";
 import type { CommandLauncher } from "#src/sandbox/index";
 import { type CodingTool, type CodingToolName, type CodingToolRuntime, type DeclaredCommandRunner, type ProtectedPathsPolicy, type ToolAuditSink, type ToolGrant, type ToolPatternNarrowing } from "#src/tools/index";
+import type { OwnedPathsPolicy } from "#src/tools/owned-paths";
 export interface CodingToolSupport {
     readonly runtime: CodingToolRuntime;
     readonly tools: readonly CodingTool[];
@@ -105,6 +106,8 @@ export declare function buildCodingToolSupport(args: {
     fileOutputPath?: string;
     /** nax#2260: `execution.sandbox.filesystem.allowWrite`, forwarded to `compileToolPolicy`. */
     naxAllowWrite?: readonly string[];
+    /** S3-2: host-owned path rules; forwarded to compileToolPolicy and onto every ToolRunContext. nax passes naxOwnedPathsPolicy. */
+    ownedPaths?: OwnedPathsPolicy;
     bashApproval?: BashApprovalMode;
     /** Injectable ask resolver (Task 3); defaults to the headless deny resolver. */
     askResolver?: AskResolver;

package/dist/coding-tools/coding-tool-support.js

@@ -86,10 +86,12 @@ export function buildCodingToolSupport(args) {
             ...(args.askRules !== undefined ? { askRules: args.askRules } : {}),
             ...(args.fileOutputPath !== undefined ? { ownedWriteExemption: args.fileOutputPath } : {}),
             ...(args.naxAllowWrite !== undefined ? { naxAllowWrite: args.naxAllowWrite } : {}),
+            ownedPaths: args.ownedPaths,
         }),
         declaredCommands: new Set(declaredCommands.keys()),
         interceptor: args.interceptor,
         protectedPaths: args.protectedPaths,
+        ownedPaths: args.ownedPaths,
         ...(args.abortSignal !== undefined ? { signal: args.abortSignal } : {}),
         ...(args.askResolver !== undefined ? { askResolver: args.askResolver } : {}),
         ...(args.commandShadow !== undefined ? { commandShadow: args.commandShadow } : {}),

package/dist/index.d.ts

@@ -7,20 +7,38 @@
  *
  * Generated once by S2-7 from the previous `export *` barrels; maintained by hand.
  */
+export type { CommandInterceptor, InterceptRequest, InterceptResult, ShellInterceptRequest, ShellInterceptResult, } from "#src/command-interceptor/index";
 export { appendCommandSafetyRow, type BuildCommandShadowOptions, buildCommandShadow, buildRequest, type Classify, COMMAND_SAFETY_DIR, type CommandGuard, type CommandSafetyRow, type CommandShadow, type CommandShadowOptions, createCommandGuard, createCommandShadow, createSystemOneClient, detectTmpWrite, type ExecRun, type FinalOutcome, type GuardDecision, type GuardInput, HARM_OPTIONS, HARM_QUESTION_ID, type HarmOption, isTempOnly, type LedgerOutcome, type MechanicalVerdict, type ModelAnswers, type ModelResult, type Observation, openShadowTap, parseAnswer, QUESTION_IDS, QUESTION_SET_VERSION, type QuestionId, RULE_SET_VERSION, type RuleContext, type RuleResult, type ShadowCall, type ShadowTap, SYSTEMONE_MODEL_LABEL, type SystemOneClientOptions, type SystemOneQuestion, type SystemOneRequest, scoreGuard, scoreRules, shadowCacheKey, toMechanical, } from "#src/command-safety/index";
 export { addTokenUsage, estimateCostUsd, inputClassTokens, type Pricing, type PricingRates, type PricingTier, priceCall, type TokenUsage, } from "#src/cost/core/index";
 export { type ModelSpec, parseModelSpec, } from "#src/cost/model-spec";
 export type { AgentLogger, CredentialAuthConfig, CredentialsConfig } from "#src/infra/index";
-export { configureCredentials, setAgentLogger } from "#src/infra/index";
-export { AuthCancelledError, type AuthEvent, type AuthInteraction, type AuthLink, type AuthMethod, type AuthOption, type AuthPrompt, type AuthResult, ambientShadows, anyAmbientCredential, authImportOutcomeLabel, credentialFilePath, DEFAULT_PI_AUTH_PATH, type ImportOutcome, importPiCredentials, listStoredProviders, MAX_RETAINED_TRANSCRIPTS, NATIVE_AGENT, type NativeCatalogOverrides, type NativeCompleteContext, type NativeCompleteOptions, type NativeCompleteResult, NativeSessionAdapter, NativeSessionUnsupportedError, type NativeTierConfig, nativeComplete, nativeTierProviders, naxCredentialStore, newSessionKey, providersWithoutCredentials, pruneRetainedTranscripts, type ResolveResult, type ResolveStatus, removeStoredProvider, resolveNativeId, runLogin, type StoredEntry, servedAuth, } from "#src/native/index";
-export { type ApprovalAuditRow, type ApprovalEntry, type ApprovalsFile, type ApprovalsFileRead, type ApprovalsFileState, type ApprovalsTaint, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, type AskControl, type AskDecidedBy, type AskDecision, type AskLink, type AskLinkOutcome, type AskRequest, type AskResolver, type AskVerdict, appendApproval, appendApprovalAudit, approvalId, approvalsPath, type BashLexResult, type BashRedirect, type BashSegment, type BashSegmentSeparator, type BashToken, type ClearTaintOutcome, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, type MaskResult, maskForPrompt, type PrepareApprovalsStoreOptions, parseRuleList, parseToolExpression, prepareApprovalsStore, type RemovalDecision, type RemovalResult, type ResolvedPermissions, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, type SecretSpan, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
+export { configureCredentials, getLogger, setAgentLogger } from "#src/infra/index";
+export { createStderrTail, type StderrTail } from "#src/infra/stderr-tail";
+export { isProcessAlive } from "#src/internal/process-alive";
+export { killProcessGroup } from "#src/internal/process-kill";
+export { capStrings, redactSecrets } from "#src/internal/redact";
+export { NaxError } from "#src/infra/nax-error";
+export type { CredentialSource } from "#src/native/credentials/session-source";
+export { AuthCancelledError, type AuthEvent, type AuthInteraction, type AuthLink, type AuthMethod, type AuthOption, type AuthPrompt, type AuthResult, ambientShadows, anyAmbientCredential, authImportOutcomeLabel, createFileTranscriptStore, createMemoryTranscriptStore, credentialFilePath, DEFAULT_PI_AUTH_PATH, type ImportOutcome, importPiCredentials, listStoredProviders, MAX_RETAINED_TRANSCRIPTS, type MemoryTranscriptStore, NATIVE_AGENT, type NativeCatalogOverrides, type NativeCompleteContext, type NativeCompleteOptions, type NativeCompleteResult, NativeSessionAdapter, NativeSessionUnsupportedError, type NativeTierConfig, nativeComplete, nativeTierProviders, naxCredentialStore, newSessionKey, providersWithoutCredentials, pruneRetainedTranscripts, type ResolveResult, type ResolveStatus, removeStoredProvider, resolveNativeId, runLogin, type StoredEntry, servedAuth, type TranscriptAcpRecord, type TranscriptDoc, type TranscriptStore, type TurnMarker, } from "#src/native/index";
+export type { NativeSessionAdapterOptions } from "#src/native/session-adapter";
+export type { AfterResponsePatch, AfterResponsePayload, AfterToolPatch, AfterToolPayload, BeforeCompactionPatch, BeforeCompactionPayload, BeforeRequestPatch, BeforeRequestPayload, BeforeToolOutcome, BeforeToolPayload, BeforeTurnEndPatch, BeforeTurnEndPayload, BeforeTurnPatch, BeforeTurnPayload, CompleteCallOptions, ExternalHandlerOf, LoopEvent, LoopEventMap, LoopHandlerContext, LoopHandlerEntry, LoopHandlerSet, PatchOf, PayloadOf, TransformContextPatch, TransformContextPayload, } from "#src/native/session/loop-events/types";
+export { TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES } from "#src/native/session/turn-event-emitter";
+export { type ApprovalAuditRow, type ApprovalEntry, type ApprovalsFile, type ApprovalsFileRead, type ApprovalsFileState, type ApprovalsTaint, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, type AskControl, type AskDecidedBy, type AskDecision, type AskLink, type AskLinkOutcome, type AskRequest, type AskResolver, type AskVerdict, appendApproval, appendApprovalAudit, approvalId, approvalsPath, type BashLexResult, type BashRedirect, type BashSegment, type BashSegmentSeparator, type BashToken, type ClearTaintOutcome, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, type MaskResult, maskForPrompt, type PrepareApprovalsStoreOptions, parseRuleList, parseToolExpression, prepareApprovalsStore, type RemovalDecision, type RemovalResult, type ResolvedPermissions, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, type SecretSpan, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { type AgentGlobOptions, type AgentRuntime, type AgentSpawnOptions, type AgentSpawnResult, type AgentSpawnStdin, getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
 export { buildSandboxPolicy, type CommandLauncher, type CommandLauncherOptions, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, defaultTempRoots, denialHintLine, type GitLayout, type LaunchRequest, type LaunchResult, type LaunchSpec, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, type ProbeResult, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, type SandboxBackend, type SandboxBackendName, type SandboxNetworkPolicy, type SandboxPolicy, type SandboxPolicyInput, type SandboxRecord, type SandboxState, type SandboxWrapRequest, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
 export type { AdapterFailure } from "#src/session/adapter-failure";
+export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
+export { AgentSessionError, type AgentSessionErrorCode } from "#src/session/agent-session-errors";
+export type { AgentSession, AgentSessionHostPorts, AgentSessionProfile, AnswerReply, AnswerStatus, ApprovalDecidedBy, CostSource, CreateAgentSessionOptions, EmbedderTool, EmbedderToolContext, EmbedderToolResult, SessionEvent, SessionEventBase, SessionEventBody, TurnEndStatus, } from "#src/session/agent-session-types";
 export type { AgentAwaitingHumanEvent, AgentCallEndedEvent, AgentCallStartedEvent, AgentMessageUpdateEvent, AgentProcessUpdateEvent, AgentStreamEvent, AgentStreamEventBase, AgentThinkingUpdateEvent, AgentToolCallUpdateEvent, AgentUsageUpdateEvent, } from "#src/session/agent-stream-events";
 export { type AdapterInteraction, type AdapterInteractionResponse, type InteractionHandler, NO_OP_INTERACTION_HANDLER, } from "#src/session/interaction-handler";
+export { nativeBackend } from "#src/session/native-backend";
+export type { NativeBackendOptions } from "#src/session/native-backend-options";
 export type { ProtocolIds } from "#src/session/protocol-types";
+export type { ApprovalRequest, BackendInfo, BackendOpenContext, OpenedBackend, SessionAskPort, SessionBackend, TurnContribution, } from "#src/session/session-backend";
 export { type AgentSessionAdapter, type AuthStamp, type InteractionExchange, type InvalidToolCallDetail, type OpenSessionOpts, type SendTurnOpts, type SessionHandle, type SessionModel, SessionTurnError, type TrackedSpawnDeadlineOptions, type TurnResult, } from "#src/session/session-types";
 export type { JSONSchema, ToolDescriptor, } from "#src/session/tool-descriptor";
 export { createTurnDeadline, type TurnDeadline, } from "#src/session/turn-deadline";
+export type { TurnEvent, TurnEventSink } from "#src/session/turn-event";
 export { adaptProviderTool, advertisedSchemaBytes, applyModelTruncationPolicy, BASH_TIMEOUT_MS, BASH_TOOL_NAME, buildCommitArgvs, buildGitArgv, buildGrepArgv, type CodingTool, type CodingToolName, type CodingToolOutcome, type CodingToolRuntime, classifyExec, compileToolPolicy, createBashTool, createCodingToolRuntime, createNoOpToolAuditSink, createRunCommandTool, createToolAuditSink, cutBufferToByteCap, DEFAULT_BASH_SHELL, DEFAULT_LOG_FORMAT, DEFAULT_LOG_MAX_COUNT, DEFAULT_TOOL_MAX_BYTES, DEFAULT_TOOL_MAX_FILE_BYTES, type DeclaredCommandRequest, type DeclaredCommandResult, type DeclaredCommandRunner, deleteTool, EXEC_TOOL_NAME, type ExecTarget, editTool, expandMcpRuleGrants, expandProviderGrants, flushOpenToolAuditSinks, GIT_ESCAPE_FLAGS, GIT_READ_VERBS, getCodingTool, gitCommitTool, gitExcludePathspecsOf, gitIgnorePatternsOf, gitTool, globTool, grepTool, isKnownManager, listCodingTools, MAX_PROVIDER_DESCRIPTION_BYTES, MAX_PROVIDER_SCHEMA_BYTES, MCP_RULE_TOOL, MODEL_MAX_BYTES, MODEL_MAX_LINE_CHARS, MODEL_MAX_LINES, type ModelTruncationOptions, mcpRuleAdmits, type NormalizeInput, type NormalizeResult, namespacedToolName, narrowGrants, normalizeExec, normalizeManagerBinary, type PolicyVerdict, PROVIDER_ID_RE, type ProtectedPathsPolicy, type ProviderGrantEntry, type ProviderKind, type ProviderTool, partitionMcpRules, partitionNaxOwnedPaths, providerAttachesTo, READ_CEILING, RESERVED_TOOL_NAMES, type ReadFileSliceOptions, type ReadFileSliceResult, type RegisteredSink, type ResolvedProviderTools, readFileSlice, readTool, registerBuiltinCodingTools, registerBuiltinTool, registerCodingTool, registerToolAuditSink, requestCapabilityTool, resolveProviderTools, resolveWithin, SCRATCHPAD_DIR, SPILL_DIR, type SpillRequest, sanitizeProviderTools, scratchpadListTool, scratchpadReadTool, scratchpadWriteTool, spillRelativePath, substituteCommand, substituteCommandSpec, type ToolAuditSink, type ToolCallContext, type ToolCallRecord, type ToolGrant, type ToolPatternNarrowing, type ToolPolicy, type ToolPolicyOptions, type ToolProvider, type ToolResult, type ToolRunContext, type ToolScope, type TruncateForModelOptions, type TruncationDirection, type TruncationResult, truncateForModel, truncationDirectionFor, unregisterToolAuditSink, validateProviderId, writeSpill, writeTool, } from "#src/tools/index";
+export { EMPTY_OWNED_PATHS_POLICY, type OwnedBashCandidate, type OwnedPathsPolicy, } from "#src/tools/owned-paths";

package/dist/index.js

@@ -10,12 +10,22 @@
 export { appendCommandSafetyRow, buildCommandShadow, buildRequest, COMMAND_SAFETY_DIR, createCommandGuard, createCommandShadow, createSystemOneClient, detectTmpWrite, HARM_OPTIONS, HARM_QUESTION_ID, isTempOnly, openShadowTap, parseAnswer, QUESTION_IDS, QUESTION_SET_VERSION, RULE_SET_VERSION, SYSTEMONE_MODEL_LABEL, scoreGuard, scoreRules, shadowCacheKey, toMechanical, } from "#src/command-safety/index";
 export { addTokenUsage, estimateCostUsd, inputClassTokens, priceCall, } from "#src/cost/core/index";
 export { parseModelSpec, } from "#src/cost/model-spec";
-export { configureCredentials, setAgentLogger } from "#src/infra/index";
-export { AuthCancelledError, ambientShadows, anyAmbientCredential, authImportOutcomeLabel, credentialFilePath, DEFAULT_PI_AUTH_PATH, importPiCredentials, listStoredProviders, MAX_RETAINED_TRANSCRIPTS, NATIVE_AGENT, NativeSessionAdapter, NativeSessionUnsupportedError, nativeComplete, nativeTierProviders, naxCredentialStore, newSessionKey, providersWithoutCredentials, pruneRetainedTranscripts, removeStoredProvider, resolveNativeId, runLogin, servedAuth, } from "#src/native/index";
-export { ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, appendApproval, appendApprovalAudit, approvalId, approvalsPath, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, maskForPrompt, parseRuleList, parseToolExpression, prepareApprovalsStore, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
+export { configureCredentials, getLogger, setAgentLogger } from "#src/infra/index";
+export { createStderrTail } from "#src/infra/stderr-tail";
+export { isProcessAlive } from "#src/internal/process-alive";
+export { killProcessGroup } from "#src/internal/process-kill";
+export { capStrings, redactSecrets } from "#src/internal/redact";
+export { NaxError } from "#src/infra/nax-error";
+export { AuthCancelledError, ambientShadows, anyAmbientCredential, authImportOutcomeLabel, createFileTranscriptStore, createMemoryTranscriptStore, credentialFilePath, DEFAULT_PI_AUTH_PATH, importPiCredentials, listStoredProviders, MAX_RETAINED_TRANSCRIPTS, NATIVE_AGENT, NativeSessionAdapter, NativeSessionUnsupportedError, nativeComplete, nativeTierProviders, naxCredentialStore, newSessionKey, providersWithoutCredentials, pruneRetainedTranscripts, removeStoredProvider, resolveNativeId, runLogin, servedAuth, } from "#src/native/index";
+export { TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES } from "#src/native/session/turn-event-emitter";
+export { ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, appendApproval, appendApprovalAudit, approvalId, approvalsPath, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, maskForPrompt, parseRuleList, parseToolExpression, prepareApprovalsStore, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
 export { buildSandboxPolicy, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, defaultTempRoots, denialHintLine, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
+export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
+export { AgentSessionError } from "#src/session/agent-session-errors";
 export { NO_OP_INTERACTION_HANDLER, } from "#src/session/interaction-handler";
+export { nativeBackend } from "#src/session/native-backend";
 export { SessionTurnError, } from "#src/session/session-types";
 export { createTurnDeadline, } from "#src/session/turn-deadline";
 export { adaptProviderTool, advertisedSchemaBytes, applyModelTruncationPolicy, BASH_TIMEOUT_MS, BASH_TOOL_NAME, buildCommitArgvs, buildGitArgv, buildGrepArgv, classifyExec, compileToolPolicy, createBashTool, createCodingToolRuntime, createNoOpToolAuditSink, createRunCommandTool, createToolAuditSink, cutBufferToByteCap, DEFAULT_BASH_SHELL, DEFAULT_LOG_FORMAT, DEFAULT_LOG_MAX_COUNT, DEFAULT_TOOL_MAX_BYTES, DEFAULT_TOOL_MAX_FILE_BYTES, deleteTool, EXEC_TOOL_NAME, editTool, expandMcpRuleGrants, expandProviderGrants, flushOpenToolAuditSinks, GIT_ESCAPE_FLAGS, GIT_READ_VERBS, getCodingTool, gitCommitTool, gitExcludePathspecsOf, gitIgnorePatternsOf, gitTool, globTool, grepTool, isKnownManager, listCodingTools, MAX_PROVIDER_DESCRIPTION_BYTES, MAX_PROVIDER_SCHEMA_BYTES, MCP_RULE_TOOL, MODEL_MAX_BYTES, MODEL_MAX_LINE_CHARS, MODEL_MAX_LINES, mcpRuleAdmits, namespacedToolName, narrowGrants, normalizeExec, normalizeManagerBinary, PROVIDER_ID_RE, partitionMcpRules, partitionNaxOwnedPaths, providerAttachesTo, READ_CEILING, RESERVED_TOOL_NAMES, readFileSlice, readTool, registerBuiltinCodingTools, registerBuiltinTool, registerCodingTool, registerToolAuditSink, requestCapabilityTool, resolveProviderTools, resolveWithin, SCRATCHPAD_DIR, SPILL_DIR, sanitizeProviderTools, scratchpadListTool, scratchpadReadTool, scratchpadWriteTool, spillRelativePath, substituteCommand, substituteCommandSpec, truncateForModel, truncationDirectionFor, unregisterToolAuditSink, validateProviderId, writeSpill, writeTool, } from "#src/tools/index";
+export { EMPTY_OWNED_PATHS_POLICY, } from "#src/tools/owned-paths";

package/dist/infra/stderr-tail.d.ts

@@ -0,0 +1,8 @@
+export interface StderrTail {
+    push(chunk: string | Uint8Array): void;
+    excerpt(opts?: {
+        readonly maxBytes?: number;
+        readonly secrets?: readonly string[];
+    }): string;
+}
+export declare function createStderrTail(capacityBytes?: number): StderrTail;

package/dist/infra/stderr-tail.js

@@ -0,0 +1,48 @@
+/**
+ * A bounded tail of a child process's stderr (S4 spec 5.6, 7). Backends keep
+ * the last bytes for error excerpts; excerpt() strips control characters,
+ * redacts caller-known secrets and known token shapes, and returns at most
+ * maxBytes from the end, so an error never carries a raw agent log.
+ */
+import { redactSecrets } from "#src/internal/redact";
+const DEFAULT_CAPACITY = 65_536;
+const DEFAULT_EXCERPT = 4096;
+const MIN_SECRET_LENGTH = 4;
+// C0 controls and DEL, except tab (\u0009) and newline (\u000A).
+// biome-ignore lint/suspicious/noControlCharactersInRegex: stripping control characters is the point of this regex
+const CONTROL = /[\u0000-\u0008\u000B-\u001F\u007F]/g;
+function lastBytes(text, maxBytes) {
+    const bytes = Buffer.from(text, "utf8");
+    if (bytes.byteLength <= maxBytes)
+        return text;
+    // A cut inside a multi-byte character decodes to U+FFFD; drop it.
+    return bytes
+        .subarray(bytes.byteLength - maxBytes)
+        .toString("utf8")
+        .replace(/^�+/, "");
+}
+function scrub(text, secrets) {
+    let out = text.replace(CONTROL, "");
+    for (const secret of secrets) {
+        if (secret.length >= MIN_SECRET_LENGTH)
+            out = out.split(secret).join("[REDACTED]");
+    }
+    return redactSecrets(out);
+}
+export function createStderrTail(capacityBytes = DEFAULT_CAPACITY) {
+    const decoder = new TextDecoder();
+    let buffer = "";
+    return {
+        push(chunk) {
+            buffer += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+            // Known limitation: trimming at the raw capacity boundary can cut a
+            // caller secret in two, leaving the older half as a suffix in the buffer;
+            // excerpt() redacts only whole occurrences it sees. Capacity semantics are
+            // deliberate and stay as they are.
+            buffer = lastBytes(buffer, capacityBytes);
+        },
+        excerpt(opts = {}) {
+            return lastBytes(scrub(buffer, opts.secrets ?? []), opts.maxBytes ?? DEFAULT_EXCERPT);
+        },
+    };
+}

package/dist/internal/redact.d.ts

@@ -38,3 +38,26 @@ export declare function redactEntry<T extends {
     message: string;
     data?: Record<string, unknown>;
 }>(entry: T): T;
+/**
+ * A copy of `value` with every string cut to `scanBytes`, so a downstream
+ * regex scan (typically `redactSecrets`) never walks a multi-MB payload.
+ * Cycles become `"[Circular]"`; only the current recursion path is "seen",
+ * matching `redactValue` so a shared, non-cyclic reference is copied, not
+ * labelled.
+ *
+ * Exported for callers that need to bound their own redaction: the JSONL
+ * logger writes via `redactSecrets` without a cap because individual log
+ * entries are bounded; `native/session/turn-event-emitter.ts:cappedInput`
+ * and `session/session-interaction.ts:defaultSummary` cap before their
+ * downstream scan so a 2 MB `Write` content or embedder tool input does not
+ * run every `SECRET_VALUE_PATTERNS` regex over megabytes.
+ *
+ * The byte cap is inlined rather than imported from `tools/truncate.ts`:
+ * `internal/` is below `tools/`, so the direction is one-way. No
+ * `MAX_REDACT_DEPTH` guard here — `redactValue` carries one as a backstop
+ * against pathologically deep-but-acyclic input; capStrings is only called
+ * on values the surrounding code already bounds (tool inputs under the
+ * provider's request cap, embedder describe strings under the model call
+ * size), and any cycle is caught by the WeakSet on the current path.
+ */
+export declare function capStrings(value: unknown, scanBytes: number, seen?: WeakSet<object>): unknown;

package/dist/internal/redact.js

@@ -129,6 +129,66 @@ export function redactEntry(entry) {
 /** Depth guard is a backstop against pathological (non-circular but very deep) input; the WeakSet is what actually stops cycles. */
 const MAX_REDACT_DEPTH = 100;
 const CIRCULAR_REF_MARKER = "[Circular]";
+/**
+ * A copy of `value` with every string cut to `scanBytes`, so a downstream
+ * regex scan (typically `redactSecrets`) never walks a multi-MB payload.
+ * Cycles become `"[Circular]"`; only the current recursion path is "seen",
+ * matching `redactValue` so a shared, non-cyclic reference is copied, not
+ * labelled.
+ *
+ * Exported for callers that need to bound their own redaction: the JSONL
+ * logger writes via `redactSecrets` without a cap because individual log
+ * entries are bounded; `native/session/turn-event-emitter.ts:cappedInput`
+ * and `session/session-interaction.ts:defaultSummary` cap before their
+ * downstream scan so a 2 MB `Write` content or embedder tool input does not
+ * run every `SECRET_VALUE_PATTERNS` regex over megabytes.
+ *
+ * The byte cap is inlined rather than imported from `tools/truncate.ts`:
+ * `internal/` is below `tools/`, so the direction is one-way. No
+ * `MAX_REDACT_DEPTH` guard here — `redactValue` carries one as a backstop
+ * against pathologically deep-but-acyclic input; capStrings is only called
+ * on values the surrounding code already bounds (tool inputs under the
+ * provider's request cap, embedder describe strings under the model call
+ * size), and any cycle is caught by the WeakSet on the current path.
+ */
+export function capStrings(value, scanBytes, seen = new WeakSet()) {
+    if (typeof value === "string")
+        return cutStringToBytes(value, scanBytes);
+    if (typeof value !== "object" || value === null)
+        return value;
+    if (seen.has(value))
+        return CIRCULAR_REF_MARKER;
+    seen.add(value);
+    try {
+        if (Array.isArray(value))
+            return value.map((item) => capStrings(item, scanBytes, seen));
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, capStrings(item, scanBytes, seen)]));
+    }
+    finally {
+        seen.delete(value);
+    }
+}
+/**
+ * Backs up over UTF-8 continuation bytes so a cut inside a codepoint lands
+ * on a whole one. Mirrors `tools/truncate.ts:cutToByteCap` without the
+ * `internal/` → `tools/` dependency. Continuation bytes span `0x80`–`0xBF`
+ * (`10xxxxxx`); the predicate matches that range, not the single value
+ * `0x80`, so a multi-byte char whose boundary lands on a different
+ * continuation byte (`0xA9`, `0xB8`, …) is also rejected.
+ */
+function cutStringToBytes(body, maxBytes) {
+    if (Buffer.byteLength(body, "utf8") <= maxBytes)
+        return body;
+    const buf = Buffer.from(body, "utf8");
+    let cut = Math.min(buf.length, maxBytes);
+    while (cut > 0) {
+        const byte = buf[cut] ?? 0;
+        if (byte < 0x80 || byte > 0xbf)
+            break;
+        cut -= 1;
+    }
+    return buf.subarray(0, cut).toString("utf8");
+}
 /**
  * MED-02: unguarded recursion here threw a RangeError (stack overflow) out
  * of every logger call whenever a data payload contained a circular

package/dist/internal.d.ts

@@ -60,25 +60,32 @@ export * from "#src/native/session/compaction";
 export * from "#src/native/session/loop-events/external-handler";
 export * from "#src/native/session/loop-events/index";
 export * from "#src/native/session/loop-events/types";
+export * from "#src/native/session/memory-transcript-store";
 export * from "#src/native/session/session";
 export * as sessionModule from "#src/native/session/session";
 export * from "#src/native/session/tool-mapping";
+export * from "#src/native/session/transcript-identity";
 export * from "#src/native/session/transcript-store";
 export * as transcriptStoreModule from "#src/native/session/transcript-store";
+export * from "#src/native/session/transcript-types";
 export * from "#src/native/session/turn-accumulator";
 export * from "#src/native/session/turn-complete-step";
 export * from "#src/native/session/turn-events";
 export * from "#src/native/session/turn-loop";
 export * from "#src/native/session/turn-retry";
 export * from "#src/native/session/turn-types";
+export { nativeSessionStateOf } from "#src/native/session-adapter";
 export * from "#src/native/session-affinity";
 export * from "#src/permissions/index";
 export * from "#src/sandbox/index";
 export * as policyInputsModule from "#src/sandbox/policy-inputs";
+export * from "#src/session/agent-session-deps";
+export * from "#src/tools/credential-read-deny";
 export * from "#src/tools/git";
 export * from "#src/tools/git-commit";
 export * from "#src/tools/grep";
 export * from "#src/tools/index";
+export * from "#src/tools/owned-paths";
 export * from "#src/tools/package-managers";
 export * from "#src/tools/policy";
 export * from "#src/tools/provider-grants";

package/dist/internal.js

@@ -60,25 +60,33 @@ export * from "#src/native/session/compaction";
 export * from "#src/native/session/loop-events/external-handler";
 export * from "#src/native/session/loop-events/index";
 export * from "#src/native/session/loop-events/types";
+export * from "#src/native/session/memory-transcript-store";
 export * from "#src/native/session/session";
 export * as sessionModule from "#src/native/session/session";
 export * from "#src/native/session/tool-mapping";
+export * from "#src/native/session/transcript-identity";
 export * from "#src/native/session/transcript-store";
 export * as transcriptStoreModule from "#src/native/session/transcript-store";
+export * from "#src/native/session/transcript-types";
 export * from "#src/native/session/turn-accumulator";
 export * from "#src/native/session/turn-complete-step";
 export * from "#src/native/session/turn-events";
 export * from "#src/native/session/turn-loop";
 export * from "#src/native/session/turn-retry";
 export * from "#src/native/session/turn-types";
+export { nativeSessionStateOf } from "#src/native/session-adapter";
 export * from "#src/native/session-affinity";
 export * from "#src/permissions/index";
 export * from "#src/sandbox/index";
 export * as policyInputsModule from "#src/sandbox/policy-inputs";
+export * from "#src/session/agent-session-deps";
+export * from "#src/tools/credential-read-deny";
 export * from "#src/tools/git";
 export * from "#src/tools/git-commit";
 export * from "#src/tools/grep";
 export * from "#src/tools/index";
+// S3-2: the port (nax supplies the policy behind it from its own module).
+export * from "#src/tools/owned-paths";
 export * from "#src/tools/package-managers";
 export * from "#src/tools/policy";
 export * from "#src/tools/provider-grants";

package/dist/native/adapter-deps.d.ts

@@ -5,7 +5,7 @@
  */
 import type { AuthStamp } from "#src/session/session-types";
 import { anyAmbientCredential, listStoredProviders } from "./auth.ts";
-import { authSourceIsExec, servedAuth } from "./credentials/index.ts";
+import { authSourceIsExec, type GuardedCredentialStore, servedAuth } from "./credentials/index.ts";
 export declare function isProtocolStreamError(err: unknown): err is {
     protocolError: {
         kind: string;
@@ -39,8 +39,8 @@ export declare const _adapterDeps: {
  * `provider`, `{}` otherwise — so the key stays absent, never `undefined`. A
  * helper because `sendTurn` cannot carry another branch on the complexity
  * ratchet; it reads the `_adapterDeps` seam so a unit test can pin the stamp
- * without assembling a real store.
+ * without assembling a real store. With `store`, it reads only that store.
  */
-export declare function authFields(provider: string): {
+export declare function authFields(provider: string, store?: GuardedCredentialStore): {
     auth?: AuthStamp;
 };

package/dist/native/adapter-deps.js

@@ -35,9 +35,9 @@ export const _adapterDeps = {
  * `provider`, `{}` otherwise — so the key stays absent, never `undefined`. A
  * helper because `sendTurn` cannot carry another branch on the complexity
  * ratchet; it reads the `_adapterDeps` seam so a unit test can pin the stamp
- * without assembling a real store.
+ * without assembling a real store. With `store`, it reads only that store.
  */
-export function authFields(provider) {
-    const auth = _adapterDeps.servedAuth(provider);
+export function authFields(provider, store) {
+    const auth = store === undefined ? _adapterDeps.servedAuth(provider) : store.servedAuth(provider);
     return auth === undefined ? {} : { auth };
 }

package/dist/native/client.d.ts

@@ -8,7 +8,7 @@
  * This file and its siblings are the only place in src/ permitted to import
  * nax-ai (packages/repo-tooling/scripts/check-nax-ai-imports.ts).
  */
-import { type Client, defaultProtocols } from "@nathapp/nax-ai";
+import { type Client, type CredentialStore, defaultProtocols } from "@nathapp/nax-ai";
 import type { ProviderCatalogOverride } from "#src/config/catalog-overrides";
 /** The catalog overrides a native client is built with (`agent.native.catalogOverrides`). */
 export type NativeCatalogOverrides = readonly ProviderCatalogOverride[];
@@ -26,6 +26,12 @@ export interface BuildNativeClientOptions {
      * in tests that intentionally fail at the protocol boundary.
      */
     readonly transportRetries?: number;
+    /**
+     * The store the protocols resolve credentials from. Absent = the process
+     * store (`naxCredentialStore()`). A session that owns its credentials passes
+     * its own store, so it never reads the process slot.
+     */
+    readonly credentials?: CredentialStore;
 }
 /**
  * The real builder. Exported on its own — not just as `_clientDeps.build` —

package/dist/native/client.js

@@ -57,7 +57,7 @@ export async function buildNativeClient(catalogOverrides = [], options = {}) {
             // is what makes `nax auth login` reach a run. This is the only inlet:
             // ClientOptions once carried a `credentials` field that createClient
             // never read, and nax-ai 0.1.4 removed it for exactly that reason.
-            credentials: naxCredentialStore(),
+            credentials: options.credentials ?? naxCredentialStore(),
             // Construction-time, like `credentials`: the identity is a constant of
             // the process, so nax-ai takes it here rather than on every request.
             clientApp: NAX_CLIENT_APP,