@nathapp/nax-agent 0.90.2 → 0.90.4

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@nathapp/nax-agent` are recorded here. The format follow
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). While the version is `0.x`, a minor
 release may change the public API.
 
+## [0.90.4] - 2026-10-19
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.90.3] - 2026-10-19
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
 ## [0.90.2] - 2026-10-18
 
 - No changes in this package. Released in lockstep with the other nax packages.

package/dist/index.d.ts

@@ -26,7 +26,7 @@ export type { AfterResponsePatch, AfterResponsePayload, AfterToolPatch, AfterToo
 export { displayToolInput, TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES, toolResultPreview, } from "#src/native/session/turn-event-emitter";
 export { type ApprovalAuditRow, type ApprovalEntry, type ApprovalsFile, type ApprovalsFileRead, type ApprovalsFileState, type ApprovalsTaint, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, type AskControl, type AskDecidedBy, type AskDecision, type AskLink, type AskLinkOutcome, type AskRequest, type AskResolver, type AskVerdict, appendApproval, appendApprovalAudit, approvalId, approvalsPath, type BashLexResult, type BashRedirect, type BashSegment, type BashSegmentSeparator, type BashToken, type ClearTaintOutcome, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, type MaskResult, maskForPrompt, type PrepareApprovalsStoreOptions, parseRuleList, parseToolExpression, prepareApprovalsStore, type RemovalDecision, type RemovalResult, type ResolvedPermissions, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, type SecretSpan, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { type AgentGlobOptions, type AgentRuntime, type AgentSpawnOptions, type AgentSpawnResult, type AgentSpawnStdin, getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
-export { buildSandboxPolicy, type CommandLauncher, type CommandLauncherOptions, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, defaultTempRoots, denialHintLine, type GitLayout, type LaunchRequest, type LaunchResult, type LaunchSpec, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, type ProbeResult, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, type SandboxBackend, type SandboxBackendName, type SandboxNetworkPolicy, type SandboxPolicy, type SandboxPolicyInput, type SandboxRecord, type SandboxState, type SandboxWrapRequest, type SessionSandbox, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
+export { buildSandboxPolicy, type CommandLauncher, type CommandLauncherOptions, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, defaultTempRoots, denialHintLine, type GitLayout, type LaunchRequest, type LaunchResult, type LaunchSpec, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, type ProbeResult, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, type SandboxBackend, type SandboxBackendName, type SandboxNetworkPolicy, type SandboxPolicy, type SandboxPolicyInput, type SandboxRecord, type SandboxState, type SandboxWrapRequest, type SessionSandbox, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
 export type { AdapterFailure } from "#src/session/adapter-failure";
 export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
 export { AgentSessionError, type AgentSessionErrorCode } from "#src/session/agent-session-errors";

package/dist/index.js

@@ -21,7 +21,7 @@ export { AuthCancelledError, ambientShadows, anyAmbientCredential, authImportOut
 export { displayToolInput, TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES, toolResultPreview, } from "#src/native/session/turn-event-emitter";
 export { ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, appendApproval, appendApprovalAudit, approvalId, approvalsPath, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, maskForPrompt, parseRuleList, parseToolExpression, prepareApprovalsStore, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
-export { buildSandboxPolicy, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, defaultTempRoots, denialHintLine, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
+export { buildSandboxPolicy, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, defaultTempRoots, denialHintLine, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
 export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
 export { AgentSessionError } from "#src/session/agent-session-errors";
 export { NO_OP_INTERACTION_HANDLER, } from "#src/session/interaction-handler";

package/dist/sandbox/index.d.ts

@@ -1,6 +1,6 @@
 export { quoteArgvForShell } from "./argv-quote.ts";
 export { _gitGuardDeps, listGitGuardFiles, strayCommonDirTripwire } from "./git-guards.ts";
-export { _launcherDeps, type CommandLauncherOptions, createCommandLauncher, DISABLED_SANDBOX_STATE, } from "./launcher.ts";
+export { _launcherDeps, type CommandLauncherOptions, createCommandLauncher, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, } from "./launcher.ts";
 export { denialHintLine, LIKELY_SANDBOX_DENIAL, rawBashRefusalReason, sandboxSentence, unsandboxedSentence, } from "./messages.ts";
 export { buildSandboxPolicy, type SandboxPolicyInput } from "./policy-builder.ts";
 export { _policyInputDeps, defaultTempRoots, type GitLayout, listCredentialFiles, listNaxEntries, resolveGitLayout, runTempRoots, } from "./policy-inputs.ts";

package/dist/sandbox/index.js

@@ -1,6 +1,6 @@
 export { quoteArgvForShell } from "./argv-quote.js";
 export { _gitGuardDeps, listGitGuardFiles, strayCommonDirTripwire } from "./git-guards.js";
-export { _launcherDeps, createCommandLauncher, DISABLED_SANDBOX_STATE, } from "./launcher.js";
+export { _launcherDeps, createCommandLauncher, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, } from "./launcher.js";
 export { denialHintLine, LIKELY_SANDBOX_DENIAL, rawBashRefusalReason, sandboxSentence, unsandboxedSentence, } from "./messages.js";
 export { buildSandboxPolicy } from "./policy-builder.js";
 export { _policyInputDeps, defaultTempRoots, listCredentialFiles, listNaxEntries, resolveGitLayout, runTempRoots, } from "./policy-inputs.js";

package/dist/sandbox/launcher.d.ts

@@ -1,5 +1,6 @@
 import { runArgv } from "#src/internal/argv-exec";
 import type { CommandLauncher, SandboxBackend, SandboxPolicy, SandboxState } from "./types.ts";
+export declare const SANDBOXED_ENV = "NAX_SANDBOXED";
 export declare const DISABLED_SANDBOX_STATE: SandboxState;
 export declare const _launcherDeps: {
     runArgv: typeof runArgv;

package/dist/sandbox/launcher.js

@@ -16,6 +16,7 @@ import { getSafeLogger, NaxError } from "#src/infra/index";
 import { runArgv } from "#src/internal/argv-exec";
 import { quoteArgvForShell } from "./argv-quote.js";
 import { denialHintLine, LIKELY_SANDBOX_DENIAL } from "./messages.js";
+export const SANDBOXED_ENV = "NAX_SANDBOXED";
 export const DISABLED_SANDBOX_STATE = { kind: "disabled" };
 export const _launcherDeps = {
     runArgv,
@@ -29,10 +30,12 @@ function logicalArgv(req) {
 function shellSingleQuote(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
-/** `export TMPDIR=… TMP=… TEMP=…; ` — the prefix a wrapped command carries, since srt replaces the child env. */
+/** Every wrapped command carries the marker; srt replaces the child env. */
 function tmpEnvPrefix(tmpDir) {
+    if (tmpDir === undefined)
+        return `export ${SANDBOXED_ENV}=1; `;
     const q = shellSingleQuote(tmpDir);
-    return `export TMPDIR=${q} TMP=${q} TEMP=${q}; `;
+    return `export ${SANDBOXED_ENV}=1 TMPDIR=${q} TMP=${q} TEMP=${q}; `;
 }
 /** The TMPDIR/TMP/TEMP overlay for an unwrapped run; the request's own env wins per key. */
 function withTmpEnv(req, tmpDir) {
@@ -70,12 +73,13 @@ async function runWrapped(req, backend, policy, env) {
     const rawCommand = req.spec.kind === "shell" ? req.spec.command : quoteArgvForShell(req.spec.argv);
     // srt replaces the child environment wholesale, so a TMPDIR override cannot
     // ride an `env` overlay — it has to be part of the shell command itself.
+    // The prefix always carries NAX_SANDBOXED=1, even without a TMPDIR override.
     // Other overlay keys DO survive: the live suite proves it (`AGENT=1` reaches
     // a wrapped child — see test/integration/sandbox/sandbox-live.test.ts
     // "US-004 — the AGENT=1 overlay reaches a wrapped child"). `executed` below
     // stays the unprefixed logical argv, so the ledger records what the agent
     // wrote, not this shim.
-    const command = env.tmpDir !== undefined ? `${tmpEnvPrefix(env.tmpDir)}${rawCommand}` : rawCommand;
+    const command = `${tmpEnvPrefix(env.tmpDir)}${rawCommand}`;
     const shell = req.spec.kind === "shell" ? req.spec.shell : "/bin/sh";
     const commandId = _launcherDeps.newCommandId();
     let argv;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax-agent",
-  "version": "0.90.2",
+  "version": "0.90.4",
   "description": "nax's native coding agent: session contract, native loop, tools, permissions, sandbox, command-safety.",
   "license": "MIT",
   "author": "William Khoo",
@@ -47,7 +47,7 @@
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.77",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nathapp/nax-ai": "0.90.2",
+    "@nathapp/nax-ai": "0.90.4",
     "zod": "^4.3.6"
   },
   "publishConfig": {