@nathapp/nax-agent 0.3.1 → 0.84.0

package/dist/tools/instruction-access.d.ts

@@ -0,0 +1,13 @@
+/** Transport-neutral scope hook, invoked only after coding-tool authorization. */
+import { stat } from "node:fs/promises";
+import type { ProtectedPathsPolicy } from "./protected-paths.ts";
+import type { ToolPolicy } from "./types.ts";
+type InstructionAccess = (paths: readonly string[], canRead: (path: string) => boolean, protectedPaths?: ProtectedPathsPolicy) => Promise<string | undefined>;
+export declare const _instructionAccessDeps: {
+    stat: typeof stat;
+};
+export declare function withInstructionAccess<T>(observer: InstructionAccess, run: () => Promise<T>): Promise<T>;
+export declare function discoverAuthorizedInstructions(name: string, paths: readonly string[], policy: ToolPolicy, protectedPaths?: ProtectedPathsPolicy): Promise<string | undefined>;
+/** A mutation must be proposed again after the model has received new guidance. */
+export declare function enforceInstructionAccess(name: string, paths: readonly string[], policy: ToolPolicy, protectedPaths?: ProtectedPathsPolicy): Promise<void>;
+export {};

package/dist/tools/instruction-access.js

@@ -0,0 +1,30 @@
+/** Transport-neutral scope hook, invoked only after coding-tool authorization. */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { stat } from "node:fs/promises";
+import { dirname } from "node:path";
+import { NaxError } from "#src/infra/nax-error";
+import { credentialReadRefusal } from "./credential-read-deny.js";
+export const _instructionAccessDeps = { stat };
+const access = new AsyncLocalStorage();
+export function withInstructionAccess(observer, run) {
+    return access.run(observer, run);
+}
+export async function discoverAuthorizedInstructions(name, paths, policy, protectedPaths) {
+    if (!["Read", "Write", "Edit"].includes(name))
+        return;
+    const observer = access.getStore();
+    if (observer === undefined || paths.some((path) => credentialReadRefusal(protectedPaths, path) !== undefined))
+        return;
+    const targets = name === "Write" ? paths.map((path) => dirname(path)) : paths;
+    const present = await Promise.all(targets.map((path) => _instructionAccessDeps.stat(path).then((metadata) => (name === "Write" ? metadata.isDirectory() : metadata.isFile()), () => false)));
+    if (present.some((found) => !found))
+        return;
+    const guidance = await observer(paths, (path) => policy.check("Read", { pathFields: ["path"] }, { path }).allowed, protectedPaths);
+    return name === "Read" ? undefined : guidance || undefined;
+}
+/** A mutation must be proposed again after the model has received new guidance. */
+export async function enforceInstructionAccess(name, paths, policy, protectedPaths) {
+    const guidance = await discoverAuthorizedInstructions(name, paths, policy, protectedPaths);
+    if (guidance !== undefined)
+        throw new NaxError(guidance, "REPOSITORY_INSTRUCTIONS_DISCOVERED", { stage: "coding-tool" });
+}

package/dist/tools/runtime.js

@@ -17,6 +17,7 @@ import { gitTool } from "./git.js";
 import { gitCommitTool } from "./git-commit.js";
 import { globTool } from "./glob.js";
 import { grepTool } from "./grep.js";
+import { enforceInstructionAccess } from "./instruction-access.js";
 import { readTool } from "./read.js";
 import { getCodingTool, registerBuiltinTool } from "./registry.js";
 import { requestCapabilityTool } from "./request-capability.js";
@@ -224,7 +225,10 @@ export function createCodingToolRuntime(opts) {
                 log(tool, outcome, resultBytes, input, context, breach, reason, routineErrors, audit, resultBytesPreTruncation);
                 tap?.settle(outcome, audit?.approval?.decidedBy, audit?.executed === undefined
                     ? undefined
-                    : { executed: audit.executed, ...(audit.cwd !== undefined ? { cwd: audit.cwd } : {}) });
+                    : {
+                        executed: audit.executed,
+                        ...(audit.cwd !== undefined ? { cwd: audit.cwd } : {}),
+                    });
             };
             /**
              * Executes a permitted call and records its outcome. Shared by the
@@ -249,6 +253,7 @@ export function createCodingToolRuntime(opts) {
                 // scope.
                 const callSignal = context?.signal ?? signal;
                 try {
+                    await enforceInstructionAccess(target.name, resolvedPaths, opts.policy, opts.protectedPaths);
                     const result = await target.run(callInput, {
                         root: opts.policy.root,
                         resolvedPaths,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax-agent",
-  "version": "0.3.1",
+  "version": "0.84.0",
   "description": "nax's native coding agent: session contract, native loop, tools, permissions, sandbox, command-safety.",
   "license": "MIT",
   "author": "William Khoo",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.77",
-    "@nathapp/nax-ai": "0.1.16",
+    "@nathapp/nax-ai": "0.84.0",
     "zod": "^4.3.6"
   },
   "publishConfig": {