@nathapp/nax-agent 0.91.4 → 0.91.5

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to `@nathapp/nax-agent` are recorded here. The format follow
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). While the version is `0.x`, a minor
 release may change the public API.
 
+## [0.91.5] - 2026-10-23
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
 ## [0.91.4] - 2026-10-23
 
 - No changes in this package. Released in lockstep with the other nax packages.

package/dist/config/schemas-sandbox.js

@@ -41,7 +41,8 @@ export const SandboxConfigSchema = z.object({
         /**
          * US-002 (#2538): let a sandboxed command reach loopback ports.
          *
-         * Off when absent, and it only changes anything alongside an
+         * Absent: on when `allowedDomains` is set (see `effectiveAllowLocalBinding`),
+         * off otherwise. It only changes anything alongside an
          * `allowedDomains` list: with an open network srt's macOS profile already
          * allows all traffic. srt reads it once per process, from the config given
          * to `SandboxManager.initialize`.

package/dist/runtime/node-glob.js

@@ -1,9 +1,28 @@
-/** Node glob normalized to the agent contract and Bun's symlink traversal. */
+/**
+ * Node glob normalized to the agent contract and Bun's symlink traversal.
+ *
+ * Every dot segment hides a result (ruling D21), with one exemption: a pattern
+ * whose first segment is literally `.nax` may surface results whose first
+ * result-relative segment is `.nax` (nax's own artifacts live there). Dot
+ * segments below `.nax/` stay hidden, and so does every other hidden path.
+ */
 import { globSync, lstatSync, statSync } from "node:fs";
 import { glob } from "node:fs/promises";
 import { relative, resolve, sep } from "node:path";
+const NAX_DIR = ".nax";
+/** True when the pattern's first `/` segment is exactly `.nax`: no glob metacharacter, no escape. */
+function exemptsNaxDir(pattern) {
+    return pattern.replace(/^(?:\.\/)+/, "").split("/")[0] === NAX_DIR;
+}
+/** Whether a result-relative path has a hidden dot segment, ignoring a leading `.nax` the pattern asked for. */
+function hasHiddenSegment(path, naxExempt) {
+    return path
+        .split(sep)
+        .some((segment, index) => segment.startsWith(".") && !(naxExempt && index === 0 && segment === NAX_DIR));
+}
 function scanOptions(pattern, opts) {
     const cwd = resolve(opts.cwd);
+    const naxExempt = exemptsNaxDir(pattern);
     if (!statSync(cwd).isDirectory()) {
         throw Object.assign(new Error(`ENOTDIR: not a directory, glob '${cwd}'`), { code: "ENOTDIR", path: cwd });
     }
@@ -24,7 +43,7 @@ function scanOptions(pattern, opts) {
     };
     const exclude = (entry) => {
         const path = relative(cwd, resolve(cwd, entry.parentPath, entry.name));
-        if (path.split(sep).some((segment) => segment.startsWith(".")))
+        if (hasHiddenSegment(path, naxExempt))
             return true;
         // Node can optimize brace/class segments without reporting their symlink
         // entries. Check lexical ancestors too, allowing only the literal prefix.
@@ -45,7 +64,7 @@ function filePath(entry, cwd, absolute, pattern) {
             statSync(full, { throwIfNoEntry: false })?.isFile()))
         return null;
     const path = relative(cwd, full);
-    if (path.split(sep).some((segment) => segment.startsWith(".")))
+    if (hasHiddenSegment(path, exemptsNaxDir(pattern)))
         return null;
     const dotPrefix = pattern.match(/^(?:\.\/)+/)?.[0] ?? "";
     return absolute ? resolve(full) : `${dotPrefix}${path}`;

package/dist/sandbox/network.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxConfig } from "../config/schemas-sandbox.ts";
+/** Explicit loopback settings win; an allow-list (including []) defaults on. */
+export declare function effectiveAllowLocalBinding(network: SandboxConfig["network"]): boolean;

package/dist/sandbox/network.js

@@ -0,0 +1,6 @@
+/** Explicit loopback settings win; an allow-list (including []) defaults on. */
+export function effectiveAllowLocalBinding(network) {
+    return typeof network.allowLocalBinding === "boolean"
+        ? network.allowLocalBinding
+        : network.allowedDomains !== undefined;
+}

package/dist/sandbox/policy-builder.js

@@ -13,6 +13,7 @@ import { SANDBOX_GLOB_CHARS } from "../config/schemas-sandbox.js";
 import { CLAUDE_SETTINGS_FILES } from "./claude-settings.js";
 import { BUILTIN_CACHE_WRITE_ROOTS, BUILTIN_CREDENTIAL_READ_DENIES, MACOS_CACHE_WRITE_ROOT, SRT_MACOS_TMPDIR, SRT_MACOS_TMPDIR_DENIES, } from "./defaults.js";
 import { WORKTREE_COMMON_WRITE_DIRS, WORKTREE_CONFIG_FILE } from "./git-guards.js";
+import { effectiveAllowLocalBinding } from "./network.js";
 function expandHome(p, home) {
     if (p === "~")
         return home;
@@ -162,10 +163,8 @@ export function buildSandboxPolicy(input) {
         ...config.filesystem.denyRead.map((p) => resolve(root, expandHome(p, home))),
     ]);
     const allowed = config.network.allowedDomains;
-    // US-002: the flag is carried only when the config asks for it, so an absent
-    // -- or explicitly false -- config leaves `network` without the key. The type
-    // only admits `true` (see SandboxNetworkPolicy), and srt treats absent as off.
-    const loopback = config.network.allowLocalBinding === true;
+    // Resolve the config default before constructing a true-or-absent policy.
+    const loopback = effectiveAllowLocalBinding(config.network);
     return {
         writeRoots,
         denyWrite,

package/dist/sandbox/registry.js

@@ -4,6 +4,7 @@
  * serves one project, so one network config per process holds.
  */
 import { getSafeLogger } from "#src/infra/index";
+import { effectiveAllowLocalBinding } from "./network.js";
 import { probeSandbox } from "./probe.js";
 import { createSrtBackend } from "./srt-backend.js";
 export const _sandboxRegistryDeps = {
@@ -14,7 +15,10 @@ let backend;
 let probed;
 let warnedUnavailable = false;
 export function sandboxBackendFor(config) {
-    backend ??= _sandboxRegistryDeps.createBackend(config.network);
+    backend ??= _sandboxRegistryDeps.createBackend({
+        ...config.network,
+        allowLocalBinding: effectiveAllowLocalBinding(config.network),
+    });
     return backend;
 }
 export function probeSandboxOnce(target, storyId = "_sandbox") {

package/dist/sandbox/session-sandbox.d.ts

@@ -1,3 +1,2 @@
-/** nax#2500: a launcher's sandbox as plain data for a backend that runs its own shell. */
 import type { CommandLauncher, SessionSandbox } from "./types.ts";
-export declare function sessionSandboxFrom(launcher: CommandLauncher | undefined, root: string): Promise<SessionSandbox | undefined>;
+export declare function sessionSandboxFrom(launcher: CommandLauncher | undefined, root: string, writeExemption?: string): Promise<SessionSandbox | undefined>;

package/dist/sandbox/session-sandbox.js

@@ -1,9 +1,15 @@
-export async function sessionSandboxFrom(launcher, root) {
+/** nax#2500: a launcher's sandbox as plain data for a backend that runs its own shell. */
+import { resolve } from "node:path";
+export async function sessionSandboxFrom(launcher, root, writeExemption) {
     if (launcher === undefined || launcher.state.kind === "disabled")
         return undefined;
     if (launcher.state.kind === "unavailable")
         return { kind: "unavailable", reason: launcher.state.reason };
     if (launcher.policyAt === undefined)
         return { kind: "unavailable", reason: "the launcher exposes no policy" };
-    return { kind: "policy", policy: await launcher.policyAt(root) };
+    return {
+        kind: "policy",
+        policy: await launcher.policyAt(root),
+        ...(writeExemption === undefined ? {} : { writeExemption: resolve(root, writeExemption) }),
+    };
 }

package/dist/sandbox/types.d.ts

@@ -14,7 +14,8 @@ export interface SandboxNetworkPolicy {
      * US-002: srt may let a command bind to -- and reach -- loopback ports, so a
      * DB-backed test run sees a local server that is up (#2538).
      *
-     * `true` only. srt's own default is off, so absent and `false` are the same
+     * The config default is resolved by `effectiveAllowLocalBinding` before
+     * policy construction. `true` only. srt's own default is off, so absent and `false` are the same
      * thing to it, and a policy that cannot express "off" cannot contradict the
      * config it was built from.
      */
@@ -34,6 +35,8 @@ export interface SandboxPolicy {
 export type SessionSandbox = {
     readonly kind: "policy";
     readonly policy: SandboxPolicy;
+    /** Absolute path of the session's single writable output. */
+    readonly writeExemption?: string;
 } | {
     readonly kind: "unavailable";
     readonly reason: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax-agent",
-  "version": "0.91.4",
+  "version": "0.91.5",
   "description": "nax's native coding agent: session contract, native loop, tools, permissions, sandbox, command-safety.",
   "license": "MIT",
   "author": "William Khoo",
@@ -47,7 +47,7 @@
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.77",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nathapp/nax-ai": "0.91.4",
+    "@nathapp/nax-ai": "0.91.5",
     "zod": "^4.3.6"
   },
   "publishConfig": {