@nathapp/nax-agent 0.91.6 → 0.91.7-canary.10

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to `@nathapp/nax-agent` are recorded here. The format follow
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). While the version is `0.x`, a minor
 release may change the public API.
 
+## [0.91.7-canary.10] - 2026-10-30
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.9] - 2026-10-30
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.8] - 2026-10-29
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.7] - 2026-10-29
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.6] - 2026-10-28
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.5] - 2026-10-27
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.4] - 2026-10-27
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.3] - 2026-10-27
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.2] - 2026-10-26
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.1] - 2026-10-24
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
 ## [0.91.6] - 2026-10-24
 
 - No changes in this package. Released in lockstep with the other nax packages.

package/dist/coding-tools/coding-tool-extras.d.ts

@@ -9,6 +9,7 @@
 import type { BashApprovalMode } from "#src/config/bash-approval";
 import type { QualityCommandSpec } from "#src/internal/command-spec/index";
 import type { CommandLauncher } from "#src/sandbox/index";
+import type { BackgroundCommandPort } from "#src/tools/bash-background";
 import { type CodingTool, type DeclaredCommandRunner, type ToolGrant } from "#src/tools/index";
 export interface DeclaredCommandToolsArgs {
     readonly declaredCommands: ReadonlyMap<string, QualityCommandSpec>;
@@ -31,5 +32,56 @@ export interface DeclaredCommandToolsArgs {
     readonly runDeclaredCommand?: DeclaredCommandRunner;
     /** P4: how Bash and Exec-branch commands run; absent = direct spawn (tests). */
     readonly launcher?: CommandLauncher;
+    /**
+     * US-003/US-008: whether this session offers the per-call `unsandboxed`
+     * argument — on Bash (`createBashTool`) and on RunCommand's argv branch
+     * (`createRunCommandTool`'s `exec` option, US-008). Advertisement only:
+     * RunCommand's DECLARED-command branch has no argv to unwrap and refuses the
+     * flag by name.
+     */
+    readonly unsandboxedCommands?: boolean;
+    readonly backgroundCommands?: BackgroundCommandPort;
 }
+/**
+ * US-003: `unsandboxedCommands` as a spreadable field — present only when the
+ * session opted in, so "off" and "absent" stay one shape all the way down to
+ * `createBashTool` and to RunCommand's `exec` option (US-008).
+ *
+ * A helper rather than an inline `cond ? { field } : {}` spread because
+ * `buildDeclaredCommandTools` and `buildCodingToolSupport` both sit at their
+ * cognitive-complexity baseline and a ternary inside either one would raise it.
+ */
+export declare function unsandboxedToolOptions(args: {
+    readonly unsandboxedCommands?: boolean;
+}): {
+    readonly unsandboxedCommands?: true;
+};
+/**
+ * US-005: the same option as the RUNTIME's field — whether a `Bash`/`Exec`
+ * call may run outside the sandbox at all, plus the Bash approval mode that
+ * decides how an enabled request is routed.
+ *
+ * Absent when the session did not opt in, so "off" and "absent" stay one shape
+ * all the way to `createCodingToolRuntime` (absent means disabled). A helper
+ * for the same reason as `unsandboxedToolOptions`: `buildCodingToolSupport`
+ * sits at its cognitive-complexity baseline and a ternary inside it would
+ * raise it.
+ */
+export declare function unsandboxedRuntimeOption(args: {
+    readonly unsandboxedCommands?: boolean;
+    readonly askOnUnsandboxed?: boolean;
+    readonly bashApproval: BashApprovalMode;
+}): {
+    readonly unsandboxed?: {
+        readonly enabled: boolean;
+        readonly bashApproval: BashApprovalMode;
+        readonly alwaysAsk?: boolean;
+    };
+};
 export declare function buildDeclaredCommandTools(args: DeclaredCommandToolsArgs): CodingTool[];
+/** Preserve absence at every session/support forwarding hop. */
+export declare function backgroundToolOptions(args?: {
+    readonly backgroundCommands?: BackgroundCommandPort;
+}): {
+    readonly backgroundCommands?: BackgroundCommandPort;
+};

package/dist/coding-tools/coding-tool-extras.js

@@ -1,4 +1,46 @@
+/**
+ * The session-local tools an operation declares: RunCommand (its declared
+ * commands and, when `Exec` is declared, its argv branch) and Bash.
+ *
+ * Extracted from coding-tool-support.ts to keep that file under its 600-line
+ * source limit ahead of the P4 sandbox wiring. A pure move: every comment that
+ * explains a field below travelled with it.
+ */
 import { createBashTool, createRunCommandTool, } from "#src/tools/index";
+/**
+ * US-003: `unsandboxedCommands` as a spreadable field — present only when the
+ * session opted in, so "off" and "absent" stay one shape all the way down to
+ * `createBashTool` and to RunCommand's `exec` option (US-008).
+ *
+ * A helper rather than an inline `cond ? { field } : {}` spread because
+ * `buildDeclaredCommandTools` and `buildCodingToolSupport` both sit at their
+ * cognitive-complexity baseline and a ternary inside either one would raise it.
+ */
+export function unsandboxedToolOptions(args) {
+    return args.unsandboxedCommands === true ? { unsandboxedCommands: true } : {};
+}
+/**
+ * US-005: the same option as the RUNTIME's field — whether a `Bash`/`Exec`
+ * call may run outside the sandbox at all, plus the Bash approval mode that
+ * decides how an enabled request is routed.
+ *
+ * Absent when the session did not opt in, so "off" and "absent" stay one shape
+ * all the way to `createCodingToolRuntime` (absent means disabled). A helper
+ * for the same reason as `unsandboxedToolOptions`: `buildCodingToolSupport`
+ * sits at its cognitive-complexity baseline and a ternary inside it would
+ * raise it.
+ */
+export function unsandboxedRuntimeOption(args) {
+    if (args.unsandboxedCommands !== true)
+        return {};
+    return {
+        unsandboxed: {
+            enabled: true,
+            bashApproval: args.bashApproval,
+            ...(args.askOnUnsandboxed === true ? { alwaysAsk: true } : {}),
+        },
+    };
+}
 export function buildDeclaredCommandTools(args) {
     return [
         ...(args.declaredCommands.size > 0 || args.allowExec
@@ -31,6 +73,10 @@ export function buildDeclaredCommandTools(args) {
                                 patterns: args.execGrant?.patterns ?? [],
                                 ...(args.packageName !== undefined ? { packageName: args.packageName } : {}),
                                 ...(args.launcher !== undefined ? { launcher: args.launcher } : {}),
+                                // US-008: the same option Bash takes, forwarded to the argv
+                                // branch's advertisement through the same helper — one
+                                // shape for "off" and "absent" on both tools.
+                                ...unsandboxedToolOptions(args),
                             },
                         }
                         : {}),
@@ -49,8 +95,18 @@ export function buildDeclaredCommandTools(args) {
                     bashApproval: args.bashApproval,
                     ...(args.humanApproval === true ? { humanApproval: true } : {}),
                     ...(args.launcher !== undefined ? { launcher: args.launcher } : {}),
+                    ...unsandboxedToolOptions(args),
+                    ...bashBackgroundOption(args),
                 }),
             ]
             : []),
     ];
 }
+/** Preserve absence at every session/support forwarding hop. */
+export function backgroundToolOptions(args) {
+    return args?.backgroundCommands === undefined ? {} : { backgroundCommands: args.backgroundCommands };
+}
+/** Only Bash receives this capability; RunCommand's argv branch stays unchanged. */
+function bashBackgroundOption(args) {
+    return args.backgroundCommands === undefined ? {} : { background: args.backgroundCommands };
+}

package/dist/coding-tools/coding-tool-support.d.ts

@@ -14,6 +14,7 @@ import type { BashApprovalMode } from "#src/config/bash-approval";
 import type { QualityCommandSpec } from "#src/internal/command-spec/index";
 import type { AskResolver } from "#src/permissions/index";
 import type { CommandLauncher } from "#src/sandbox/index";
+import type { BackgroundCommandPort } from "#src/tools/bash-background";
 import { type CodingTool, type CodingToolName, type CodingToolRuntime, type DeclaredCommandRunner, type ProtectedPathsPolicy, type ToolAuditSink, type ToolGrant, type ToolPatternNarrowing, type ToolSurfaceDraft, type ToolSurfaceRecord } from "#src/tools/index";
 import type { OwnedPathsPolicy } from "#src/tools/owned-paths";
 export interface CodingToolSupport {
@@ -142,6 +143,14 @@ export declare function buildCodingToolSupport(args: {
     commandShadow?: CommandShadow;
     /** P4: resolved by resolveCodingToolSupport (async); data only here. */
     launcher?: CommandLauncher;
+    /**
+     * US-003: whether this session offers Bash's per-call `unsandboxed` argument
+     * (the session profile's `allowUnsandboxedCommands`). Advertisement only —
+     * the runtime's own reading of the field is a later story.
+     */
+    unsandboxedCommands?: boolean;
+    backgroundCommands?: BackgroundCommandPort;
+    askOnUnsandboxed?: boolean;
     /** US-001: forwarded into ToolRunContext so Bash/Exec can SIGKILL on cancel. */
     abortSignal?: AbortSignal;
     /**

package/dist/coding-tools/coding-tool-support.js

@@ -11,7 +11,7 @@
 import { getSafeLogger, NaxError } from "#src/infra/index";
 import { advertisedSchemaBytes, BASH_TOOL_NAME, compileToolPolicy, createCodingToolRuntime, createNoOpToolAuditSink, createToolAuditSink, EXEC_TOOL_NAME, } from "#src/tools/index";
 import { resolveBashSupport } from "./coding-tool-bash.js";
-import { buildDeclaredCommandTools } from "./coding-tool-extras.js";
+import { backgroundToolOptions, buildDeclaredCommandTools, unsandboxedRuntimeOption, unsandboxedToolOptions, } from "./coding-tool-extras.js";
 import { isTempConfined, rawScreenOptionsFor } from "./coding-tool-sandbox.js";
 export function buildCodingToolSupport(args) {
     if (args.declared.length === 0)
@@ -119,9 +119,20 @@ export function buildCodingToolSupport(args) {
                 ...(args.stripEnvVars !== undefined ? { stripEnvVars: args.stripEnvVars } : {}),
                 ...(args.shell !== undefined ? { shell: args.shell } : {}),
                 ...(args.launcher !== undefined ? { launcher: args.launcher } : {}),
+                ...unsandboxedToolOptions(args),
+                ...backgroundToolOptions(args),
             }),
         ],
         ...(args.providerIdByTool !== undefined ? { providerIdByTool: args.providerIdByTool } : {}),
+        // US-005: the escape option reaches the RUNTIME too, not just the Bash
+        // schema — with the locally resolved mode, so a caller that left
+        // `bashApproval` unset cannot enable an escape under a mode it did not
+        // choose.
+        ...unsandboxedRuntimeOption({
+            unsandboxedCommands: args.unsandboxedCommands,
+            askOnUnsandboxed: args.askOnUnsandboxed,
+            bashApproval,
+        }),
     });
     const tools = runtime.advertised(advertised);
     // The fixed per-hop cost of advertising provider tools: their schemas enter

package/dist/config/catalog-overrides.d.ts

@@ -91,6 +91,11 @@ export interface CatalogModelOverride {
      * `protocol: "openai-completions"` (nax-ai `assertOverrideModelRouting`).
      */
     openRouterRouting?: OpenRouterRouting;
+    /**
+     * Thinking wire format for an `openai-completions` model (nax#2696).
+     * Mirrored from nax-ai's ThinkingFormat; omit to inherit the provider's format.
+     */
+    thinkingFormat?: "openai" | "qwen" | "qwen-chat-template" | "deepseek" | "zai" | "openrouter";
 }
 /** Provider-scoped catalog overrides — maps 1:1 onto nax-ai's `ProviderOverride[]`. */
 export interface ProviderCatalogOverride {
@@ -100,6 +105,10 @@ export interface ProviderCatalogOverride {
      * not to `models` individually, despite sitting alongside a model list.
      */
     baseUrl?: string;
+    /** Environment variable supplying a custom provider's bearer credential. */
+    authEnv?: string;
+    /** Config/precheck opt-in only; never forwarded to nax-ai or enforced here. */
+    allowInsecureHttp?: boolean;
     /** Provider-wide extra request headers (nax#2019). May carry credentials. */
     headers?: Record<string, string>;
     models: CatalogModelOverride[];

package/dist/index.d.ts

@@ -24,13 +24,14 @@ export { AuthCancelledError, type AuthEvent, type AuthInteraction, type AuthLink
 export type { NativeSessionAdapterOptions } from "#src/native/session-adapter";
 export type { AfterResponsePatch, AfterResponsePayload, AfterToolPatch, AfterToolPayload, BeforeCompactionPatch, BeforeCompactionPayload, BeforeRequestPatch, BeforeRequestPayload, BeforeToolOutcome, BeforeToolPayload, BeforeTurnEndPatch, BeforeTurnEndPayload, BeforeTurnPatch, BeforeTurnPayload, CompleteCallOptions, ExternalHandlerOf, LoopEvent, LoopEventMap, LoopHandlerContext, LoopHandlerEntry, LoopHandlerSet, PatchOf, PayloadOf, TransformContextPatch, TransformContextPayload, } from "#src/native/session/loop-events/types";
 export { displayToolInput, TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES, toolResultPreview, } from "#src/native/session/turn-event-emitter";
-export { type ApprovalAuditRow, type ApprovalEntry, type ApprovalsFile, type ApprovalsFileRead, type ApprovalsFileState, type ApprovalsTaint, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, type AskControl, type AskDecidedBy, type AskDecision, type AskLink, type AskLinkOutcome, type AskRequest, type AskResolver, type AskVerdict, appendApproval, appendApprovalAudit, approvalId, approvalsPath, type BashLexResult, type BashRedirect, type BashSegment, type BashSegmentSeparator, type BashToken, type ClearTaintOutcome, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, type MaskResult, maskForPrompt, type PrepareApprovalsStoreOptions, parseRuleList, parseToolExpression, prepareApprovalsStore, type RemovalDecision, type RemovalResult, type ResolvedPermissions, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, type SecretSpan, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
+export { type ApprovalAuditRow, type ApprovalEntry, type ApprovalMemoryDecision, type ApprovalMemoryRequest, approvalMemoryApplies, approvalMemoryKey, type ApprovalsFile, type ApprovalsFileRead, type ApprovalsFileState, type ApprovalsTaint, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, type AskControl, type AskDecidedBy, type AskDecision, type AskLink, type AskLinkOutcome, type AskRequest, type AskResolver, type AskVerdict, appendApproval, appendApprovalAudit, approvalId, approvalsPath, type BashLexResult, type BashRedirect, type BashSegment, type BashSegmentSeparator, type BashToken, type ClearTaintOutcome, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, type MaskResult, maskForPrompt, type PrepareApprovalsStoreOptions, parseRuleList, parseToolExpression, prepareApprovalsStore, type RemovalDecision, type RemovalResult, type ResolvedPermissions, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, type SecretSpan, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { type AgentGlobOptions, type AgentRuntime, type AgentSpawnOptions, type AgentSpawnResult, type AgentSpawnStdin, getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
 export { buildSandboxPolicy, type CommandLauncher, type CommandLauncherOptions, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, defaultTempRoots, denialHintLine, type GitLayout, type LaunchRequest, type LaunchResult, type LaunchSpec, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, type ProbeResult, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, type SandboxBackend, type SandboxBackendName, type SandboxNetworkPolicy, type SandboxPolicy, type SandboxPolicyInput, type SandboxRecord, type SandboxState, type SandboxWrapRequest, type SessionSandbox, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
+export { createSessionStorage, defaultSessionsDir, processAlive, LIST_PAGE_SIZE, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, SESSION_ID_PATTERN, SESSION_META_MODES, type SessionMeta, type SessionMetaMode, type SessionListEntry, type SessionListPage, type SessionLockHolder, type SessionLockHolderState, type SessionStorage, type SessionStorageDeps, } from "#src/session-store/index";
 export type { AdapterFailure } from "#src/session/adapter-failure";
 export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
 export { AgentSessionError, type AgentSessionErrorCode } from "#src/session/agent-session-errors";
-export type { AgentSession, AgentSessionHostPorts, AgentSessionProfile, AnswerReply, AnswerStatus, ApprovalDecidedBy, CostSource, CreateAgentSessionOptions, EmbedderTool, EmbedderToolContext, EmbedderToolResult, SessionEvent, SessionEventBase, SessionEventBody, TurnEndStatus, } from "#src/session/agent-session-types";
+export type { AgentSession, AgentSessionHostPorts, AgentSessionProfile, AnswerReply, AnswerStatus, ApprovalDecidedBy, CostSource, CommandRunResult, CreateAgentSessionOptions, EmbedderTool, EmbedderToolContext, EmbedderToolResult, SessionConfigureInput, SessionEvent, SessionEventBase, SessionEventBody, TurnEndStatus, } from "#src/session/agent-session-types";
 export type { AgentAwaitingHumanEvent, AgentCallEndedEvent, AgentCallStartedEvent, AgentMessageUpdateEvent, AgentProcessUpdateEvent, AgentStreamEvent, AgentStreamEventBase, AgentThinkingUpdateEvent, AgentToolCallUpdateEvent, AgentUsageUpdateEvent, } from "#src/session/agent-stream-events";
 export { type AdapterInteraction, type AdapterInteractionResponse, type InteractionHandler, NO_OP_INTERACTION_HANDLER, } from "#src/session/interaction-handler";
 export { nativeBackend } from "#src/session/native-backend";
@@ -45,3 +46,4 @@ export type { TurnEvent, TurnEventSink } from "#src/session/turn-event";
 export { adaptProviderTool, advertisedSchemaBytes, applyModelTruncationPolicy, BASH_TIMEOUT_MS, BASH_TOOL_NAME, buildCommitArgvs, buildGitArgv, buildGrepArgv, type CodingTool, type CodingToolName, type CodingToolOutcome, type CodingToolRuntime, classifyExec, compileToolPolicy, createBashTool, createCodingToolRuntime, createNoOpToolAuditSink, createRunCommandTool, createToolAuditSink, cutBufferToByteCap, DEFAULT_BASH_SHELL, DEFAULT_LOG_FORMAT, DEFAULT_LOG_MAX_COUNT, DEFAULT_TOOL_MAX_BYTES, DEFAULT_TOOL_MAX_FILE_BYTES, type DeclaredCommandRequest, type DeclaredCommandResult, type DeclaredCommandRunner, deleteTool, EXEC_TOOL_NAME, type ExecTarget, editTool, expandMcpRuleGrants, expandProviderGrants, flushOpenToolAuditSinks, GIT_ESCAPE_FLAGS, GIT_READ_VERBS, getCodingTool, gitCommitTool, gitExcludePathspecsOf, gitIgnorePatternsOf, gitTool, globTool, grepTool, isKnownManager, listCodingTools, MAX_PROVIDER_DESCRIPTION_BYTES, MAX_PROVIDER_SCHEMA_BYTES, MCP_INSTRUCTIONS_MAX_CHARS_PER_SERVER, MCP_INSTRUCTIONS_MAX_CHARS_TOTAL, MCP_RULE_TOOL, MODEL_MAX_BYTES, MODEL_MAX_LINE_CHARS, MODEL_MAX_LINES, type ModelTruncationOptions, mcpRuleAdmits, type NormalizeInput, type NormalizeResult, namespacedToolName, narrowGrants, normalizeExec, normalizeManagerBinary, type PolicyVerdict, PROVIDER_ID_RE, type ProtectedPathsPolicy, type ProviderGrantEntry, type ProviderKind, type ProviderTool, partitionMcpRules, partitionNaxOwnedPaths, providerAttachesTo, READ_CEILING, RESERVED_TOOL_NAMES, type ReadFileSliceOptions, type ReadFileSliceResult, type RegisteredSink, type ResolvedProviderTools, readFileSlice, readTool, registerBuiltinCodingTools, registerBuiltinTool, registerCodingTool, registerToolAuditSink, renderProviderInstructions, requestCapabilityTool, resolveProviderTools, resolveWithin, SCRATCHPAD_DIR, SPILL_DIR, type SpillRequest, sanitizeProviderTools, scratchpadListTool, scratchpadReadTool, scratchpadWriteTool, spillRelativePath, substituteCommand, substituteCommandSpec, type ToolAuditHeader, type ToolAuditSink, type ToolCallContext, type ToolCallRecord, type ToolGrant, type ToolPatternNarrowing, type ToolPolicy, type ToolPolicyOptions, type ToolProvider, type ToolResult, type ToolRunContext, type ToolScope, type ToolSurfaceDraft, type ToolSurfaceRecord, type TruncateForModelOptions, type TruncationDirection, type TruncationResult, truncateForModel, truncationDirectionFor, unregisterToolAuditSink, validateProviderId, writeSpill, writeTool, } from "#src/tools/index";
 export { compileArgvPattern, matchesArgvPattern, type CompiledPattern } from "#src/tools/policy-match";
 export { EMPTY_OWNED_PATHS_POLICY, type OwnedBashCandidate, type OwnedPathsPolicy, } from "#src/tools/owned-paths";
+export type { BackgroundCommandPort, BackgroundCommandHandle, BackgroundCommandSink, BackgroundCommandEnd, ForegroundCommand, } from "#src/tools/bash-background";

package/dist/index.js

@@ -19,9 +19,10 @@ export { NaxError } from "#src/infra/nax-error";
 export { createTerminalAuthInteraction, PLAIN_STYLE, PromptCancelledError, } from "#src/terminal-auth/index";
 export { AuthCancelledError, ambientShadows, anyAmbientCredential, authImportOutcomeLabel, createFileTranscriptStore, createMemoryTranscriptStore, credentialFilePath, DEFAULT_PI_AUTH_PATH, importPiCredentials, listProviderModels, listStoredProviders, loginProviderIds, MAX_RETAINED_TRANSCRIPTS, NATIVE_AGENT, NativeSessionAdapter, NativeSessionUnsupportedError, nativeComplete, nativeTierProviders, naxCredentialStore, newSessionKey, providersWithoutCredentials, pruneRetainedTranscripts, removeStoredProvider, resolveNativeId, runLogin, servedAuth, } from "#src/native/index";
 export { displayToolInput, TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES, toolResultPreview, } from "#src/native/session/turn-event-emitter";
-export { ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, appendApproval, appendApprovalAudit, approvalId, approvalsPath, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, maskForPrompt, parseRuleList, parseToolExpression, prepareApprovalsStore, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
+export { approvalMemoryApplies, approvalMemoryKey, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, appendApproval, appendApprovalAudit, approvalId, approvalsPath, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, maskForPrompt, parseRuleList, parseToolExpression, prepareApprovalsStore, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
 export { buildSandboxPolicy, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, defaultTempRoots, denialHintLine, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
+export { createSessionStorage, defaultSessionsDir, processAlive, LIST_PAGE_SIZE, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, SESSION_ID_PATTERN, SESSION_META_MODES, } from "#src/session-store/index";
 export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
 export { AgentSessionError } from "#src/session/agent-session-errors";
 export { NO_OP_INTERACTION_HANDLER, } from "#src/session/interaction-handler";

package/dist/internal/argv-exec.d.ts

@@ -18,6 +18,10 @@ export interface RunArgvOptions {
      * and the result resolves with `aborted: true`. US-001.
      */
     readonly signal?: AbortSignal;
+    /** Abort to remove only the deadline, without cancelling the command. */
+    readonly releaseDeadline?: AbortSignal;
+    /** Observes every read chunk before capture; observer exceptions are ignored. */
+    readonly onOutput?: (stream: "stdout" | "stderr", chunk: Uint8Array) => void;
 }
 export interface ArgvExecResult {
     readonly exitCode: number;
@@ -45,6 +49,8 @@ export declare const _argvExecDeps: {
      * stays at the DRAIN_GRACE_MS constant.
      */
     drainGraceMs: number;
+    /** Per-stream capture cap (STREAM_CAPTURE_BYTES); a test shrinks it to exercise the cut. */
+    streamCaptureBytes: number;
     /**
      * Injectable timer pair — lets the BUG-13 "hung install" test drive the
      * timeout off a virtual clock instead of waiting the full 1s schema minimum.

package/dist/internal/argv-exec.js

@@ -23,6 +23,15 @@ import { killProcessGroup } from "./process-kill.js";
  * Injectable for tests; not exposed as user configuration.
  */
 export const DRAIN_GRACE_MS = 500;
+/**
+ * Most bytes of ONE stream runArgv keeps in memory: its first half and its last half, with the
+ * middle replaced by a marker naming how much was dropped. Callers cap what they show far below
+ * this (Bash at READ_CEILING, 2 MB), so it bounds the work rather than the answer: before it, a
+ * `yes` or a looping test runner was buffered whole for up to the timeout and could exhaust the
+ * orchestrator's memory. The stream is still read to EOF, so the child never blocks or takes a
+ * SIGPIPE on a full pipe; the tail survives because that is where a failure's error usually is.
+ */
+const STREAM_CAPTURE_BYTES = 8_000_000;
 /** Injectable seam, mirroring _worktreeDependencyDeps. */
 export const _argvExecDeps = {
     spawn: runtimeSpawn,
@@ -33,6 +42,8 @@ export const _argvExecDeps = {
      * stays at the DRAIN_GRACE_MS constant.
      */
     drainGraceMs: DRAIN_GRACE_MS,
+    /** Per-stream capture cap (STREAM_CAPTURE_BYTES); a test shrinks it to exercise the cut. */
+    streamCaptureBytes: STREAM_CAPTURE_BYTES,
     /**
      * Injectable timer pair — lets the BUG-13 "hung install" test drive the
      * timeout off a virtual clock instead of waiting the full 1s schema minimum.
@@ -73,13 +84,12 @@ function buildEnv(options) {
  * after a process-group kill: a child that ignores the kill cannot pin
  * runArgv forever on its still-open pipe.
  */
-async function drainToEof(stream, signal) {
+async function drainToEof(stream, signal, onChunk) {
     const reader = stream.getReader();
-    const decoder = new TextDecoder();
-    let text = "";
+    const capture = new BoundedCapture(_argvExecDeps.streamCaptureBytes);
     const onAbort = () => {
         // Closing the stream forces the in-flight `read()` below to resolve with
-        // `{done: true}`; any bytes already captured stay in `text`.
+        // `{done: true}`; any bytes already captured stay in `capture`.
         reader.cancel().catch(() => {
             // Cancelling after the pipe already closed is a no-op race; ignore.
         });
@@ -90,16 +100,23 @@ async function drainToEof(stream, signal) {
             const { done, value } = await reader.read();
             if (done === true)
                 break;
-            if (value !== undefined)
-                text += decoder.decode(value, { stream: true });
+            if (value !== undefined) {
+                try {
+                    // Copy even Buffer-backed chunks: observers must not mutate captured bytes.
+                    onChunk?.(Uint8Array.from(value));
+                }
+                catch {
+                    // Observers are best-effort: never let one truncate capture or stop draining.
+                }
+                capture.push(value);
+            }
         }
     }
     catch {
         // Stream cancelled by SIGKILL on the process group; the partial text
-        // is still in `text`, so resolve with closed=false and let the caller
+        // is still in `capture`, so resolve with what it holds and let the caller
         // decide.
     }
-    text += decoder.decode();
     if (signal !== undefined)
         signal.removeEventListener("abort", onAbort);
     try {
@@ -108,7 +125,81 @@ async function drainToEof(stream, signal) {
     catch {
         // Already released; nothing to do.
     }
-    return { text, closed: true };
+    return { text: capture.text(), closed: true };
+}
+/**
+ * Keeps the first and the last `maxBytes / 2` bytes of a stream and counts what falls between
+ * (STREAM_CAPTURE_BYTES). The head is decoded as it arrives; the tail is kept as bytes, trimmed from
+ * the front, and decoded once at the end from a codepoint boundary.
+ */
+class BoundedCapture {
+    half;
+    decoder = new TextDecoder();
+    head = "";
+    headBytes = 0;
+    tail = [];
+    tailBytes = 0;
+    omitted = 0;
+    constructor(maxBytes) {
+        this.half = Math.max(1, Math.floor(maxBytes / 2));
+    }
+    push(chunk) {
+        let rest = chunk;
+        if (this.headBytes < this.half) {
+            const take = Math.min(this.half - this.headBytes, rest.length);
+            this.head += this.decoder.decode(rest.subarray(0, take), { stream: true });
+            this.headBytes += take;
+            rest = rest.subarray(take);
+        }
+        if (rest.length === 0)
+            return;
+        this.tail.push(rest);
+        this.tailBytes += rest.length;
+        while (this.tailBytes > this.half) {
+            const first = this.tail[0];
+            const excess = this.tailBytes - this.half;
+            if (first.length <= excess) {
+                this.tail.shift();
+                this.tailBytes -= first.length;
+                this.omitted += first.length;
+            }
+            else {
+                this.tail[0] = first.subarray(excess);
+                this.tailBytes -= excess;
+                this.omitted += excess;
+            }
+        }
+    }
+    text() {
+        const tail = Buffer.concat(this.tail);
+        if (this.omitted === 0)
+            return this.head + this.decoder.decode(tail);
+        // The cut can land inside a codepoint: skip its continuation bytes so the tail opens cleanly.
+        let start = 0;
+        while (start < tail.length && (tail[start] & 0xc0) === 0x80)
+            start += 1;
+        const head = this.head + this.decoder.decode();
+        const marker = `\n[... ${this.omitted + start} bytes of output omitted ...]\n`;
+        return head + marker + new TextDecoder().decode(tail.subarray(start));
+    }
+}
+/** The deadline is releasable independently of command cancellation and drain grace. */
+function armDeadline(options, onTimeout) {
+    let timerId;
+    const release = () => {
+        if (timerId !== undefined)
+            _argvExecDeps.clearTimeout(timerId);
+        timerId = undefined;
+    };
+    if (options.releaseDeadline?.aborted !== true) {
+        // A cancellable timer: releaseDeadline and settlement both clear it mid-flight.
+        timerId = _argvExecDeps.setTimeout(onTimeout, options.timeoutMs);
+        options.releaseDeadline?.addEventListener("abort", release, { once: true });
+    }
+    return () => {
+        release();
+        options.releaseDeadline?.removeEventListener("abort", release);
+    };
 }
 export async function runArgv(options) {
     const signal = options.signal;
@@ -145,14 +236,14 @@ export async function runArgv(options) {
     // BUG-13: unlike every git call (routed through gitWithTimeout), a spawn
     // with no deadline can block its caller forever on a hung install
     // (registry/NFS stall).
-    const timerId = _argvExecDeps.setTimeout(() => {
+    const clearDeadline = armDeadline(options, () => {
         timedOut = true;
         // MEM-4: proc.kill() reaches only the direct child, orphaning postinstall
         // grandchildren. killProcessGroup(pid, "SIGKILL") kills the whole group
         // (negative pid), falling back to the single process on ESRCH.
         killGroup();
         stopReaders();
-    }, options.timeoutMs);
+    });
     // US-001: an abort races the timeout. One listener, removed on every settle
     // path so a never-aborted signal never leaks a registration (AC10).
     const onAbort = () => {
@@ -168,57 +259,61 @@ export async function runArgv(options) {
     // to settle (via reader.cancel()) after we kill the process group. US-001
     // requires that settlement stay bounded even when a background process
     // inherits the pipe and ignores the SIGKILL.
-    const stdoutPromise = drainToEof(proc.stdout, stdoutController.signal);
-    const stderrPromise = drainToEof(proc.stderr, stderrController.signal);
-    const exitCode = await proc.exited;
-    // Post-exit drain grace. After exit, the streams MUST close — they were
-    // owned by the shell, which is now dead. Background processes that
-    // inherited the pipe (the `&` case) keep it open: that's the orphan.
-    const graceMs = _argvExecDeps.drainGraceMs;
-    // Cleared on every settle path: a successful command whose readers close
-    // before the grace elapses would otherwise leave a pending timer whose
-    // callback fires 500ms later and resolves an orphaned promise. Under load
-    // the leaked registrations accumulate in the timer wheel for nothing.
-    let graceTimerId;
-    const gracePromise = new Promise((resolve) => {
-        graceTimerId = _argvExecDeps.setTimeout(() => resolve("expired"), graceMs);
-    });
-    const stdoutSettled = await Promise.race([
-        stdoutPromise,
-        gracePromise.then(() => "expired"),
-    ]);
-    const stderrSettled = await Promise.race([
-        stderrPromise,
-        gracePromise.then(() => "expired"),
-    ]);
-    if (graceTimerId !== undefined)
-        _argvExecDeps.clearTimeout(graceTimerId);
-    const stdoutClosed = stdoutSettled !== "expired";
-    const stderrClosed = stderrSettled !== "expired";
-    if (!stdoutClosed || !stderrClosed) {
-        orphansKilled = true;
-        killGroup();
-        // The OS should close the pipes once the group dies; race that against
-        // a small post-kill budget. If a holdout somehow ignores SIGKILL or is
-        // not yet reaped, abort the matching reader controller — that drives
-        // `reader.cancel()` in drainToEof, which forces the pending `read()` to
-        // resolve with `done: true` and bounds settlement.
-        if (!stdoutClosed)
-            stdoutController.abort();
-        if (!stderrClosed)
-            stderrController.abort();
+    try {
+        const stdoutPromise = drainToEof(proc.stdout, stdoutController.signal, options.onOutput?.bind(undefined, "stdout"));
+        const stderrPromise = drainToEof(proc.stderr, stderrController.signal, options.onOutput?.bind(undefined, "stderr"));
+        const exitCode = await proc.exited;
+        // Post-exit drain grace. After exit, the streams MUST close — they were
+        // owned by the shell, which is now dead. Background processes that
+        // inherited the pipe (the `&` case) keep it open: that's the orphan.
+        const graceMs = _argvExecDeps.drainGraceMs;
+        // Cleared on every settle path: a successful command whose readers close
+        // before the grace elapses would otherwise leave a pending timer whose
+        // callback fires 500ms later and resolves an orphaned promise. Under load
+        // the leaked registrations accumulate in the timer wheel for nothing.
+        let graceTimerId;
+        const gracePromise = new Promise((resolve) => {
+            graceTimerId = _argvExecDeps.setTimeout(() => resolve("expired"), graceMs);
+        });
+        const stdoutSettled = await Promise.race([
+            stdoutPromise,
+            gracePromise.then(() => "expired"),
+        ]);
+        const stderrSettled = await Promise.race([
+            stderrPromise,
+            gracePromise.then(() => "expired"),
+        ]);
+        if (graceTimerId !== undefined)
+            _argvExecDeps.clearTimeout(graceTimerId);
+        const stdoutClosed = stdoutSettled !== "expired";
+        const stderrClosed = stderrSettled !== "expired";
+        if (!stdoutClosed || !stderrClosed) {
+            orphansKilled = true;
+            killGroup();
+            // The OS should close the pipes once the group dies; race that against
+            // a small post-kill budget. If a holdout somehow ignores SIGKILL or is
+            // not yet reaped, abort the matching reader controller — that drives
+            // `reader.cancel()` in drainToEof, which forces the pending `read()` to
+            // resolve with `done: true` and bounds settlement.
+            if (!stdoutClosed)
+                stdoutController.abort();
+            if (!stderrClosed)
+                stderrController.abort();
+        }
+        // Always await the readers to harvest whatever they captured.
+        const stdoutFinal = stdoutClosed ? stdoutSettled : await stdoutPromise;
+        const stderrFinal = stderrClosed ? stderrSettled : await stderrPromise;
+        return {
+            exitCode,
+            stdout: stdoutFinal.text,
+            stderr: stderrFinal.text,
+            timedOut,
+            aborted,
+            orphansKilled,
+        };
+    }
+    finally {
+        clearDeadline();
+        signal?.removeEventListener("abort", onAbort);
     }
-    // Always await the readers to harvest whatever they captured.
-    const stdoutFinal = stdoutClosed ? stdoutSettled : await stdoutPromise;
-    const stderrFinal = stderrClosed ? stderrSettled : await stderrPromise;
-    _argvExecDeps.clearTimeout(timerId);
-    signal?.removeEventListener("abort", onAbort);
-    return {
-        exitCode,
-        stdout: stdoutFinal.text,
-        stderr: stderrFinal.text,
-        timedOut,
-        aborted,
-        orphansKilled,
-    };
 }