@nathapp/nax-agent 0.91.6 → 0.91.7-canary.1

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to `@nathapp/nax-agent` are recorded here. The format follow
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). While the version is `0.x`, a minor
 release may change the public API.
 
+## [0.91.7-canary.1] - 2026-10-24
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
 ## [0.91.6] - 2026-10-24
 
 - No changes in this package. Released in lockstep with the other nax packages.

package/dist/internal/argv-exec.d.ts

@@ -45,6 +45,8 @@ export declare const _argvExecDeps: {
      * stays at the DRAIN_GRACE_MS constant.
      */
     drainGraceMs: number;
+    /** Per-stream capture cap (STREAM_CAPTURE_BYTES); a test shrinks it to exercise the cut. */
+    streamCaptureBytes: number;
     /**
      * Injectable timer pair — lets the BUG-13 "hung install" test drive the
      * timeout off a virtual clock instead of waiting the full 1s schema minimum.

package/dist/internal/argv-exec.js

@@ -23,6 +23,15 @@ import { killProcessGroup } from "./process-kill.js";
  * Injectable for tests; not exposed as user configuration.
  */
 export const DRAIN_GRACE_MS = 500;
+/**
+ * Most bytes of ONE stream runArgv keeps in memory: its first half and its last half, with the
+ * middle replaced by a marker naming how much was dropped. Callers cap what they show far below
+ * this (Bash at READ_CEILING, 2 MB), so it bounds the work rather than the answer: before it, a
+ * `yes` or a looping test runner was buffered whole for up to the timeout and could exhaust the
+ * orchestrator's memory. The stream is still read to EOF, so the child never blocks or takes a
+ * SIGPIPE on a full pipe; the tail survives because that is where a failure's error usually is.
+ */
+const STREAM_CAPTURE_BYTES = 8_000_000;
 /** Injectable seam, mirroring _worktreeDependencyDeps. */
 export const _argvExecDeps = {
     spawn: runtimeSpawn,
@@ -33,6 +42,8 @@ export const _argvExecDeps = {
      * stays at the DRAIN_GRACE_MS constant.
      */
     drainGraceMs: DRAIN_GRACE_MS,
+    /** Per-stream capture cap (STREAM_CAPTURE_BYTES); a test shrinks it to exercise the cut. */
+    streamCaptureBytes: STREAM_CAPTURE_BYTES,
     /**
      * Injectable timer pair — lets the BUG-13 "hung install" test drive the
      * timeout off a virtual clock instead of waiting the full 1s schema minimum.
@@ -75,11 +86,10 @@ function buildEnv(options) {
  */
 async function drainToEof(stream, signal) {
     const reader = stream.getReader();
-    const decoder = new TextDecoder();
-    let text = "";
+    const capture = new BoundedCapture(_argvExecDeps.streamCaptureBytes);
     const onAbort = () => {
         // Closing the stream forces the in-flight `read()` below to resolve with
-        // `{done: true}`; any bytes already captured stay in `text`.
+        // `{done: true}`; any bytes already captured stay in `capture`.
         reader.cancel().catch(() => {
             // Cancelling after the pipe already closed is a no-op race; ignore.
         });
@@ -91,15 +101,14 @@ async function drainToEof(stream, signal) {
             if (done === true)
                 break;
             if (value !== undefined)
-                text += decoder.decode(value, { stream: true });
+                capture.push(value);
         }
     }
     catch {
         // Stream cancelled by SIGKILL on the process group; the partial text
-        // is still in `text`, so resolve with closed=false and let the caller
+        // is still in `capture`, so resolve with what it holds and let the caller
         // decide.
     }
-    text += decoder.decode();
     if (signal !== undefined)
         signal.removeEventListener("abort", onAbort);
     try {
@@ -108,7 +117,63 @@ async function drainToEof(stream, signal) {
     catch {
         // Already released; nothing to do.
     }
-    return { text, closed: true };
+    return { text: capture.text(), closed: true };
+}
+/**
+ * Keeps the first and the last `maxBytes / 2` bytes of a stream and counts what falls between
+ * (STREAM_CAPTURE_BYTES). The head is decoded as it arrives; the tail is kept as bytes, trimmed from
+ * the front, and decoded once at the end from a codepoint boundary.
+ */
+class BoundedCapture {
+    half;
+    decoder = new TextDecoder();
+    head = "";
+    headBytes = 0;
+    tail = [];
+    tailBytes = 0;
+    omitted = 0;
+    constructor(maxBytes) {
+        this.half = Math.max(1, Math.floor(maxBytes / 2));
+    }
+    push(chunk) {
+        let rest = chunk;
+        if (this.headBytes < this.half) {
+            const take = Math.min(this.half - this.headBytes, rest.length);
+            this.head += this.decoder.decode(rest.subarray(0, take), { stream: true });
+            this.headBytes += take;
+            rest = rest.subarray(take);
+        }
+        if (rest.length === 0)
+            return;
+        this.tail.push(rest);
+        this.tailBytes += rest.length;
+        while (this.tailBytes > this.half) {
+            const first = this.tail[0];
+            const excess = this.tailBytes - this.half;
+            if (first.length <= excess) {
+                this.tail.shift();
+                this.tailBytes -= first.length;
+                this.omitted += first.length;
+            }
+            else {
+                this.tail[0] = first.subarray(excess);
+                this.tailBytes -= excess;
+                this.omitted += excess;
+            }
+        }
+    }
+    text() {
+        const tail = Buffer.concat(this.tail);
+        if (this.omitted === 0)
+            return this.head + this.decoder.decode(tail);
+        // The cut can land inside a codepoint: skip its continuation bytes so the tail opens cleanly.
+        let start = 0;
+        while (start < tail.length && (tail[start] & 0xc0) === 0x80)
+            start += 1;
+        const head = this.head + this.decoder.decode();
+        const marker = `\n[... ${this.omitted + start} bytes of output omitted ...]\n`;
+        return head + marker + new TextDecoder().decode(tail.subarray(start));
+    }
 }
 export async function runArgv(options) {
     const signal = options.signal;

package/dist/native/session/loop-events/types.d.ts

@@ -128,6 +128,11 @@ export interface BeforeRequestPatch {
  * parameter, not a new concept.
  */
 export interface CompleteCallOptions {
+    /**
+     * `false` asks for no thinking on this request; on a model that cannot
+     * disable thinking it gets the least thinking the model supports instead.
+     * `true` keeps the session's resolved level.
+     */
     readonly thinking?: boolean;
     readonly temperature?: number;
 }

package/dist/native/session-adapter.js

@@ -271,6 +271,12 @@ export class NativeSessionAdapter {
                             messages: [...span, { role: "user", content: summaryPrompt(previousSummary) }],
                             sessionId,
                             signal,
+                            // A summary restates the transcript; it does not need reasoning.
+                            // "off", not an absent level: absent means the backend default,
+                            // which on a model that cannot disable thinking is adaptive at
+                            // effort high (#2686). The client clamps "off" to the least
+                            // thinking such a model allows.
+                            thinking: "off",
                         });
                         const summaryUsage = res.usage;
                         const { costUsd, resolvedRates } = priceCall(summaryUsage, rates);
@@ -299,11 +305,16 @@ export class NativeSessionAdapter {
                     const signal = AbortSignal.any(opts.signal !== undefined
                         ? [opts.signal, controller.signal, turnController.signal, deadlineController.signal]
                         : [controller.signal, turnController.signal, deadlineController.signal]);
-                    // The loop-event bag speaks in booleans: `false` explicitly drops
-                    // the session's inherited thinking level for this request, while
-                    // `true` leaves that resolved level in place. nax-ai accepts a
-                    // thinking LEVEL rather than a boolean, so normalize at this boundary.
-                    const requestThinking = requestOptions?.thinking === false ? undefined : thinking;
+                    // The loop-event bag speaks in booleans: `false` turns thinking off
+                    // for this request, while `true` leaves the session's resolved level
+                    // in place. nax-ai accepts a thinking LEVEL rather than a boolean, so
+                    // normalize at this boundary. `false` must become "off", not an
+                    // absent level: absent means the backend default, which on a model
+                    // that cannot disable thinking is adaptive at effort high (#2686).
+                    // nax-ai clamps "off" to the lowest level such a model supports, so
+                    // there `false` still enables thinking, and a `temperature` set
+                    // alongside it is dropped by the backend as for any thinking request.
+                    const requestThinking = requestOptions?.thinking === false ? "off" : thinking;
                     try {
                         instructionInteraction.acknowledge();
                         const res = await billedOnFailure(rates, () => streamComplete(client, resolved, {

package/dist/sandbox/claude-settings.d.ts

@@ -41,6 +41,7 @@ export declare const CLAUDE_SETTINGS_FILES: readonly string[];
  * policy compile time, so a symlink created mid-session is still seen.
  *
  * Segment-exact on the full path — a sibling such as `settings.json.bak`, or any
- * other file under `.claude/`, is an ordinary path a tool must still reach.
+ * other file under `.claude/`, is an ordinary path a tool must still reach. The
+ * compare ignores case: `.Claude/settings.json` is the same file on macOS and Windows.
  */
 export declare function claudeSettingsWriteRefusal(tool: string, rel: string, resolvedRoot: string): string | undefined;

package/dist/sandbox/claude-settings.js

@@ -53,15 +53,19 @@ const CLAUDE_SETTINGS_WRITE_TOOLS = new Set(["Write", "Edit", "Delete"]);
  * policy compile time, so a symlink created mid-session is still seen.
  *
  * Segment-exact on the full path — a sibling such as `settings.json.bak`, or any
- * other file under `.claude/`, is an ordinary path a tool must still reach.
+ * other file under `.claude/`, is an ordinary path a tool must still reach. The
+ * compare ignores case: `.Claude/settings.json` is the same file on macOS and Windows.
  */
 export function claudeSettingsWriteRefusal(tool, rel, resolvedRoot) {
     if (!CLAUDE_SETTINGS_WRITE_TOOLS.has(tool))
         return undefined;
-    const entry = CLAUDE_SETTINGS_FILES.find((e) => e === rel || resolvedSettingsRel(resolvedRoot, e) === rel);
+    // Case-folded for the same reason as the `.git/` ban: on a case-insensitive filesystem
+    // `.Claude/settings.json` is the settings file, under a spelling a literal compare misses.
+    const folded = rel.toLowerCase();
+    const entry = CLAUDE_SETTINGS_FILES.find((e) => e.toLowerCase() === folded || resolvedSettingsRel(resolvedRoot, e).toLowerCase() === folded);
     if (entry === undefined)
         return undefined;
-    const subject = entry === rel
+    const subject = entry.toLowerCase() === folded
         ? `"${rel}" is a Claude Code settings file`
         : `"${rel}" is the target of the Claude Code settings file "${entry}"`;
     return (`${subject}: Claude loads allow rules, hooks and MCP servers from it for every ` +

package/dist/sandbox/defaults.js

@@ -44,4 +44,5 @@ export const BUILTIN_CREDENTIAL_READ_DENIES = [
     ".pypirc",
     ".git-credentials",
     ".config/gh",
+    ".config/glab-cli",
 ];

package/dist/tools/policy-match.d.ts

@@ -20,7 +20,7 @@ import type { ToolGrant } from "./types.ts";
  * -- but it made a *scoped* grant wider than its author wrote, which is the one
  * thing a scoped profile exists to prevent.
  */
-export declare function globToRegExp(pattern: string): RegExp;
+export declare function globToRegExp(pattern: string, ignoreCase?: boolean): RegExp;
 /** A compiled glob, keeping its source so verb names can be told from paths. */
 export interface CompiledPattern {
     readonly source: string;
@@ -55,7 +55,7 @@ export declare function matchedGlobSource(patterns: readonly CompiledPattern[],
  * is exactly bun, argv[1] starts with add", never "the space-joined argv
  * matches this glob".
  */
-export declare function compileArgvPattern(pattern: string): readonly CompiledPattern[];
+export declare function compileArgvPattern(pattern: string, ignoreCase?: boolean): readonly CompiledPattern[];
 /** A grant pattern's tokens are a PREFIX of argv — trailing argv tokens
  * (the package name, flags, ...) are the payload a prefix grant like
  * `bun add*` does not itself constrain. */

package/dist/tools/policy-match.js

@@ -19,7 +19,7 @@
  * -- but it made a *scoped* grant wider than its author wrote, which is the one
  * thing a scoped profile exists to prevent.
  */
-export function globToRegExp(pattern) {
+export function globToRegExp(pattern, ignoreCase = false) {
     let out = "";
     for (let i = 0; i < pattern.length; i += 1) {
         const char = pattern[i];
@@ -46,7 +46,7 @@ export function globToRegExp(pattern) {
         }
         out += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
     }
-    return new RegExp(`^${out}$`);
+    return new RegExp(`^${out}$`, ignoreCase ? "i" : "");
 }
 export function matchesAny(patterns, value) {
     return patterns.some((p) => p.re.test(value));
@@ -64,11 +64,11 @@ export function matchedGlobSource(patterns, value) {
  * is exactly bun, argv[1] starts with add", never "the space-joined argv
  * matches this glob".
  */
-export function compileArgvPattern(pattern) {
+export function compileArgvPattern(pattern, ignoreCase = false) {
     return pattern
         .split(/\s+/)
         .filter((token) => token.length > 0)
-        .map((token) => ({ source: token, re: globToRegExp(token) }));
+        .map((token) => ({ source: token, re: globToRegExp(token, ignoreCase) }));
 }
 /** A grant pattern's tokens are a PREFIX of argv — trailing argv tokens
  * (the package name, flags, ...) are the payload a prefix grant like
@@ -96,8 +96,11 @@ export function compileRuleMap(rules) {
         const nonWildcard = patterns.filter((p) => p !== "*");
         map.set(rule.tool, {
             unconditional: patterns.includes("*"),
-            matchers: nonWildcard.map((source) => ({ source, re: globToRegExp(source) })),
-            argvPatterns: nonWildcard.map((source) => compileArgvPattern(source)),
+            // Case-insensitive, unlike grants: on a case-insensitive filesystem `.ENV` and `.env` are one
+            // file, and a deny/ask rule must not be walked past by respelling it (nax#1972, as denyPaths).
+            // Over-matching only asks or refuses more, the direction these lists should fail in.
+            matchers: nonWildcard.map((source) => ({ source, re: globToRegExp(source, true) })),
+            argvPatterns: nonWildcard.map((source) => compileArgvPattern(source, true)),
             raw: patterns,
             rulePatterns: [...(existing?.rulePatterns ?? []), rule.patterns],
         });

package/dist/tools/policy-paths-branch.js

@@ -46,7 +46,10 @@ function entersGitMetadata(root, resolved) {
     const rel = relative(realOrRaw(root), resolved);
     if (rel === "" || rel.startsWith(".."))
         return false;
-    return rel.split(sep).includes(".git");
+    // Case-folded: on a case-insensitive filesystem (macOS, Windows defaults) `.GIT/config` IS
+    // `.git/config`, and the canonical path keeps the caller's spelling. Over-refusing a genuinely
+    // distinct `.GIT` on a case-sensitive filesystem is the direction this ban should fail in.
+    return rel.split(sep).some((segment) => segment.toLowerCase() === ".git");
 }
 /**
  * Absolute, symlink-resolved form of `candidate` if it lies inside `root`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax-agent",
-  "version": "0.91.6",
+  "version": "0.91.7-canary.1",
   "description": "nax's native coding agent: session contract, native loop, tools, permissions, sandbox, command-safety.",
   "license": "MIT",
   "author": "William Khoo",
@@ -47,13 +47,13 @@
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.77",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nathapp/nax-ai": "0.91.6",
+    "@nathapp/nax-ai": "0.91.7-canary.1",
     "zod": "^4.3.6"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
     "provenance": true,
-    "tag": "latest"
+    "tag": "canary"
   }
 }