@nathapp/nax-agent 0.91.6 → 0.91.7-canary.2

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@nathapp/nax-agent` are recorded here. The format follow
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). While the version is `0.x`, a minor
 release may change the public API.
 
+## [0.91.7-canary.2] - 2026-10-26
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
+## [0.91.7-canary.1] - 2026-10-24
+
+- No changes in this package. Released in lockstep with the other nax packages.
+
 ## [0.91.6] - 2026-10-24
 
 - No changes in this package. Released in lockstep with the other nax packages.

package/dist/coding-tools/coding-tool-extras.d.ts

@@ -31,5 +31,47 @@ export interface DeclaredCommandToolsArgs {
     readonly runDeclaredCommand?: DeclaredCommandRunner;
     /** P4: how Bash and Exec-branch commands run; absent = direct spawn (tests). */
     readonly launcher?: CommandLauncher;
+    /**
+     * US-003/US-008: whether this session offers the per-call `unsandboxed`
+     * argument — on Bash (`createBashTool`) and on RunCommand's argv branch
+     * (`createRunCommandTool`'s `exec` option, US-008). Advertisement only:
+     * RunCommand's DECLARED-command branch has no argv to unwrap and refuses the
+     * flag by name.
+     */
+    readonly unsandboxedCommands?: boolean;
 }
+/**
+ * US-003: `unsandboxedCommands` as a spreadable field — present only when the
+ * session opted in, so "off" and "absent" stay one shape all the way down to
+ * `createBashTool` and to RunCommand's `exec` option (US-008).
+ *
+ * A helper rather than an inline `cond ? { field } : {}` spread because
+ * `buildDeclaredCommandTools` and `buildCodingToolSupport` both sit at their
+ * cognitive-complexity baseline and a ternary inside either one would raise it.
+ */
+export declare function unsandboxedToolOptions(args: {
+    readonly unsandboxedCommands?: boolean;
+}): {
+    readonly unsandboxedCommands?: true;
+};
+/**
+ * US-005: the same option as the RUNTIME's field — whether a `Bash`/`Exec`
+ * call may run outside the sandbox at all, plus the Bash approval mode that
+ * decides how an enabled request is routed.
+ *
+ * Absent when the session did not opt in, so "off" and "absent" stay one shape
+ * all the way to `createCodingToolRuntime` (absent means disabled). A helper
+ * for the same reason as `unsandboxedToolOptions`: `buildCodingToolSupport`
+ * sits at its cognitive-complexity baseline and a ternary inside it would
+ * raise it.
+ */
+export declare function unsandboxedRuntimeOption(args: {
+    readonly unsandboxedCommands?: boolean;
+    readonly bashApproval: BashApprovalMode;
+}): {
+    readonly unsandboxed?: {
+        readonly enabled: boolean;
+        readonly bashApproval: BashApprovalMode;
+    };
+};
 export declare function buildDeclaredCommandTools(args: DeclaredCommandToolsArgs): CodingTool[];

package/dist/coding-tools/coding-tool-extras.js

@@ -1,4 +1,30 @@
 import { createBashTool, createRunCommandTool, } from "#src/tools/index";
+/**
+ * US-003: `unsandboxedCommands` as a spreadable field — present only when the
+ * session opted in, so "off" and "absent" stay one shape all the way down to
+ * `createBashTool` and to RunCommand's `exec` option (US-008).
+ *
+ * A helper rather than an inline `cond ? { field } : {}` spread because
+ * `buildDeclaredCommandTools` and `buildCodingToolSupport` both sit at their
+ * cognitive-complexity baseline and a ternary inside either one would raise it.
+ */
+export function unsandboxedToolOptions(args) {
+    return args.unsandboxedCommands === true ? { unsandboxedCommands: true } : {};
+}
+/**
+ * US-005: the same option as the RUNTIME's field — whether a `Bash`/`Exec`
+ * call may run outside the sandbox at all, plus the Bash approval mode that
+ * decides how an enabled request is routed.
+ *
+ * Absent when the session did not opt in, so "off" and "absent" stay one shape
+ * all the way to `createCodingToolRuntime` (absent means disabled). A helper
+ * for the same reason as `unsandboxedToolOptions`: `buildCodingToolSupport`
+ * sits at its cognitive-complexity baseline and a ternary inside it would
+ * raise it.
+ */
+export function unsandboxedRuntimeOption(args) {
+    return args.unsandboxedCommands === true ? { unsandboxed: { enabled: true, bashApproval: args.bashApproval } } : {};
+}
 export function buildDeclaredCommandTools(args) {
     return [
         ...(args.declaredCommands.size > 0 || args.allowExec
@@ -31,6 +57,10 @@ export function buildDeclaredCommandTools(args) {
                                 patterns: args.execGrant?.patterns ?? [],
                                 ...(args.packageName !== undefined ? { packageName: args.packageName } : {}),
                                 ...(args.launcher !== undefined ? { launcher: args.launcher } : {}),
+                                // US-008: the same option Bash takes, forwarded to the argv
+                                // branch's advertisement through the same helper — one
+                                // shape for "off" and "absent" on both tools.
+                                ...unsandboxedToolOptions(args),
                             },
                         }
                         : {}),
@@ -49,6 +79,7 @@ export function buildDeclaredCommandTools(args) {
                     bashApproval: args.bashApproval,
                     ...(args.humanApproval === true ? { humanApproval: true } : {}),
                     ...(args.launcher !== undefined ? { launcher: args.launcher } : {}),
+                    ...unsandboxedToolOptions(args),
                 }),
             ]
             : []),

package/dist/coding-tools/coding-tool-support.d.ts

@@ -142,6 +142,12 @@ export declare function buildCodingToolSupport(args: {
     commandShadow?: CommandShadow;
     /** P4: resolved by resolveCodingToolSupport (async); data only here. */
     launcher?: CommandLauncher;
+    /**
+     * US-003: whether this session offers Bash's per-call `unsandboxed` argument
+     * (the session profile's `allowUnsandboxedCommands`). Advertisement only —
+     * the runtime's own reading of the field is a later story.
+     */
+    unsandboxedCommands?: boolean;
     /** US-001: forwarded into ToolRunContext so Bash/Exec can SIGKILL on cancel. */
     abortSignal?: AbortSignal;
     /**

package/dist/coding-tools/coding-tool-support.js

@@ -11,7 +11,7 @@
 import { getSafeLogger, NaxError } from "#src/infra/index";
 import { advertisedSchemaBytes, BASH_TOOL_NAME, compileToolPolicy, createCodingToolRuntime, createNoOpToolAuditSink, createToolAuditSink, EXEC_TOOL_NAME, } from "#src/tools/index";
 import { resolveBashSupport } from "./coding-tool-bash.js";
-import { buildDeclaredCommandTools } from "./coding-tool-extras.js";
+import { buildDeclaredCommandTools, unsandboxedRuntimeOption, unsandboxedToolOptions } from "./coding-tool-extras.js";
 import { isTempConfined, rawScreenOptionsFor } from "./coding-tool-sandbox.js";
 export function buildCodingToolSupport(args) {
     if (args.declared.length === 0)
@@ -119,9 +119,15 @@ export function buildCodingToolSupport(args) {
                 ...(args.stripEnvVars !== undefined ? { stripEnvVars: args.stripEnvVars } : {}),
                 ...(args.shell !== undefined ? { shell: args.shell } : {}),
                 ...(args.launcher !== undefined ? { launcher: args.launcher } : {}),
+                ...unsandboxedToolOptions(args),
             }),
         ],
         ...(args.providerIdByTool !== undefined ? { providerIdByTool: args.providerIdByTool } : {}),
+        // US-005: the escape option reaches the RUNTIME too, not just the Bash
+        // schema — with the locally resolved mode, so a caller that left
+        // `bashApproval` unset cannot enable an escape under a mode it did not
+        // choose.
+        ...unsandboxedRuntimeOption({ unsandboxedCommands: args.unsandboxedCommands, bashApproval }),
     });
     const tools = runtime.advertised(advertised);
     // The fixed per-hop cost of advertising provider tools: their schemas enter

package/dist/config/catalog-overrides.d.ts

@@ -91,6 +91,11 @@ export interface CatalogModelOverride {
      * `protocol: "openai-completions"` (nax-ai `assertOverrideModelRouting`).
      */
     openRouterRouting?: OpenRouterRouting;
+    /**
+     * Thinking wire format for an `openai-completions` model (nax#2696).
+     * Mirrored from nax-ai's ThinkingFormat; omit to inherit the provider's format.
+     */
+    thinkingFormat?: "openai" | "qwen" | "qwen-chat-template" | "deepseek" | "zai";
 }
 /** Provider-scoped catalog overrides — maps 1:1 onto nax-ai's `ProviderOverride[]`. */
 export interface ProviderCatalogOverride {

package/dist/index.d.ts

@@ -24,13 +24,14 @@ export { AuthCancelledError, type AuthEvent, type AuthInteraction, type AuthLink
 export type { NativeSessionAdapterOptions } from "#src/native/session-adapter";
 export type { AfterResponsePatch, AfterResponsePayload, AfterToolPatch, AfterToolPayload, BeforeCompactionPatch, BeforeCompactionPayload, BeforeRequestPatch, BeforeRequestPayload, BeforeToolOutcome, BeforeToolPayload, BeforeTurnEndPatch, BeforeTurnEndPayload, BeforeTurnPatch, BeforeTurnPayload, CompleteCallOptions, ExternalHandlerOf, LoopEvent, LoopEventMap, LoopHandlerContext, LoopHandlerEntry, LoopHandlerSet, PatchOf, PayloadOf, TransformContextPatch, TransformContextPayload, } from "#src/native/session/loop-events/types";
 export { displayToolInput, TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES, toolResultPreview, } from "#src/native/session/turn-event-emitter";
-export { type ApprovalAuditRow, type ApprovalEntry, type ApprovalsFile, type ApprovalsFileRead, type ApprovalsFileState, type ApprovalsTaint, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, type AskControl, type AskDecidedBy, type AskDecision, type AskLink, type AskLinkOutcome, type AskRequest, type AskResolver, type AskVerdict, appendApproval, appendApprovalAudit, approvalId, approvalsPath, type BashLexResult, type BashRedirect, type BashSegment, type BashSegmentSeparator, type BashToken, type ClearTaintOutcome, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, type MaskResult, maskForPrompt, type PrepareApprovalsStoreOptions, parseRuleList, parseToolExpression, prepareApprovalsStore, type RemovalDecision, type RemovalResult, type ResolvedPermissions, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, type SecretSpan, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
+export { type ApprovalAuditRow, type ApprovalEntry, type ApprovalMemoryDecision, type ApprovalMemoryRequest, approvalMemoryApplies, approvalMemoryKey, type ApprovalsFile, type ApprovalsFileRead, type ApprovalsFileState, type ApprovalsTaint, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, type AskControl, type AskDecidedBy, type AskDecision, type AskLink, type AskLinkOutcome, type AskRequest, type AskResolver, type AskVerdict, appendApproval, appendApprovalAudit, approvalId, approvalsPath, type BashLexResult, type BashRedirect, type BashSegment, type BashSegmentSeparator, type BashToken, type ClearTaintOutcome, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, type MaskResult, maskForPrompt, type PrepareApprovalsStoreOptions, parseRuleList, parseToolExpression, prepareApprovalsStore, type RemovalDecision, type RemovalResult, type ResolvedPermissions, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, type SecretSpan, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { type AgentGlobOptions, type AgentRuntime, type AgentSpawnOptions, type AgentSpawnResult, type AgentSpawnStdin, getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
 export { buildSandboxPolicy, type CommandLauncher, type CommandLauncherOptions, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, defaultTempRoots, denialHintLine, type GitLayout, type LaunchRequest, type LaunchResult, type LaunchSpec, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, type ProbeResult, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, type SandboxBackend, type SandboxBackendName, type SandboxNetworkPolicy, type SandboxPolicy, type SandboxPolicyInput, type SandboxRecord, type SandboxState, type SandboxWrapRequest, type SessionSandbox, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
+export { createSessionStorage, defaultSessionsDir, processAlive, LIST_PAGE_SIZE, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, SESSION_ID_PATTERN, SESSION_META_MODES, type SessionMeta, type SessionMetaMode, type SessionListEntry, type SessionListPage, type SessionLockHolder, type SessionLockHolderState, type SessionStorage, type SessionStorageDeps, } from "#src/session-store/index";
 export type { AdapterFailure } from "#src/session/adapter-failure";
 export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
 export { AgentSessionError, type AgentSessionErrorCode } from "#src/session/agent-session-errors";
-export type { AgentSession, AgentSessionHostPorts, AgentSessionProfile, AnswerReply, AnswerStatus, ApprovalDecidedBy, CostSource, CreateAgentSessionOptions, EmbedderTool, EmbedderToolContext, EmbedderToolResult, SessionEvent, SessionEventBase, SessionEventBody, TurnEndStatus, } from "#src/session/agent-session-types";
+export type { AgentSession, AgentSessionHostPorts, AgentSessionProfile, AnswerReply, AnswerStatus, ApprovalDecidedBy, CostSource, CommandRunResult, CreateAgentSessionOptions, EmbedderTool, EmbedderToolContext, EmbedderToolResult, SessionEvent, SessionEventBase, SessionEventBody, TurnEndStatus, } from "#src/session/agent-session-types";
 export type { AgentAwaitingHumanEvent, AgentCallEndedEvent, AgentCallStartedEvent, AgentMessageUpdateEvent, AgentProcessUpdateEvent, AgentStreamEvent, AgentStreamEventBase, AgentThinkingUpdateEvent, AgentToolCallUpdateEvent, AgentUsageUpdateEvent, } from "#src/session/agent-stream-events";
 export { type AdapterInteraction, type AdapterInteractionResponse, type InteractionHandler, NO_OP_INTERACTION_HANDLER, } from "#src/session/interaction-handler";
 export { nativeBackend } from "#src/session/native-backend";

package/dist/index.js

@@ -19,9 +19,10 @@ export { NaxError } from "#src/infra/nax-error";
 export { createTerminalAuthInteraction, PLAIN_STYLE, PromptCancelledError, } from "#src/terminal-auth/index";
 export { AuthCancelledError, ambientShadows, anyAmbientCredential, authImportOutcomeLabel, createFileTranscriptStore, createMemoryTranscriptStore, credentialFilePath, DEFAULT_PI_AUTH_PATH, importPiCredentials, listProviderModels, listStoredProviders, loginProviderIds, MAX_RETAINED_TRANSCRIPTS, NATIVE_AGENT, NativeSessionAdapter, NativeSessionUnsupportedError, nativeComplete, nativeTierProviders, naxCredentialStore, newSessionKey, providersWithoutCredentials, pruneRetainedTranscripts, removeStoredProvider, resolveNativeId, runLogin, servedAuth, } from "#src/native/index";
 export { displayToolInput, TOOL_CALL_INPUT_BYTES, TOOL_RESULT_PREVIEW_BYTES, toolResultPreview, } from "#src/native/session/turn-event-emitter";
-export { ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, appendApproval, appendApprovalAudit, approvalId, approvalsPath, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, maskForPrompt, parseRuleList, parseToolExpression, prepareApprovalsStore, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
+export { approvalMemoryApplies, approvalMemoryKey, ASK_CANCELLED_REASON, ASK_DENIED_REASON, ASK_NO_CHANNEL_REASON, ASK_PROFILE_REASON, ASK_TIMEOUT_REASON, ASK_UNAVAILABLE_REASON, ASK_UNSHOWABLE_REASON, appendApproval, appendApprovalAudit, approvalId, approvalsPath, chainAskLinks, clearApprovalsTaint, createApprovalsLink, findApproval, findSecretSpans, headlessAskResolver, isForgeCapable, lexBashCommand, maskForPrompt, parseRuleList, parseToolExpression, prepareApprovalsStore, readApprovals, readApprovalsFile, readApprovalsFileDetailed, redactForRow, redactRowStrings, removeApprovals, taintApprovals, writeApprovalsFile, } from "#src/permissions/index";
 export { getAgentRuntime, nodeRuntime, setAgentRuntime, } from "#src/runtime/index";
 export { buildSandboxPolicy, createCommandLauncher, createSrtBackend, DISABLED_SANDBOX_STATE, SANDBOXED_ENV, defaultTempRoots, denialHintLine, LIKELY_SANDBOX_DENIAL, listCredentialFiles, listGitGuardFiles, listNaxEntries, probeSandbox, probeSandboxOnce, quoteArgvForShell, rawBashRefusalReason, resetSandboxBackend, resolveGitLayout, runTempRoots, runTmpRoot, sessionSandboxFrom, sandboxBackendFor, sandboxSentence, sessionTmpDir, sessionTmpDirUnder, strayCommonDirTripwire, unsandboxedSentence, warnSandboxUnavailableOnce, } from "#src/sandbox/index";
+export { createSessionStorage, defaultSessionsDir, processAlive, LIST_PAGE_SIZE, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, SESSION_ID_PATTERN, SESSION_META_MODES, } from "#src/session-store/index";
 export { createAgentSession, resumeAgentSession } from "#src/session/agent-session";
 export { AgentSessionError } from "#src/session/agent-session-errors";
 export { NO_OP_INTERACTION_HANDLER, } from "#src/session/interaction-handler";

package/dist/internal/argv-exec.d.ts

@@ -45,6 +45,8 @@ export declare const _argvExecDeps: {
      * stays at the DRAIN_GRACE_MS constant.
      */
     drainGraceMs: number;
+    /** Per-stream capture cap (STREAM_CAPTURE_BYTES); a test shrinks it to exercise the cut. */
+    streamCaptureBytes: number;
     /**
      * Injectable timer pair — lets the BUG-13 "hung install" test drive the
      * timeout off a virtual clock instead of waiting the full 1s schema minimum.

package/dist/internal/argv-exec.js

@@ -23,6 +23,15 @@ import { killProcessGroup } from "./process-kill.js";
  * Injectable for tests; not exposed as user configuration.
  */
 export const DRAIN_GRACE_MS = 500;
+/**
+ * Most bytes of ONE stream runArgv keeps in memory: its first half and its last half, with the
+ * middle replaced by a marker naming how much was dropped. Callers cap what they show far below
+ * this (Bash at READ_CEILING, 2 MB), so it bounds the work rather than the answer: before it, a
+ * `yes` or a looping test runner was buffered whole for up to the timeout and could exhaust the
+ * orchestrator's memory. The stream is still read to EOF, so the child never blocks or takes a
+ * SIGPIPE on a full pipe; the tail survives because that is where a failure's error usually is.
+ */
+const STREAM_CAPTURE_BYTES = 8_000_000;
 /** Injectable seam, mirroring _worktreeDependencyDeps. */
 export const _argvExecDeps = {
     spawn: runtimeSpawn,
@@ -33,6 +42,8 @@ export const _argvExecDeps = {
      * stays at the DRAIN_GRACE_MS constant.
      */
     drainGraceMs: DRAIN_GRACE_MS,
+    /** Per-stream capture cap (STREAM_CAPTURE_BYTES); a test shrinks it to exercise the cut. */
+    streamCaptureBytes: STREAM_CAPTURE_BYTES,
     /**
      * Injectable timer pair — lets the BUG-13 "hung install" test drive the
      * timeout off a virtual clock instead of waiting the full 1s schema minimum.
@@ -75,11 +86,10 @@ function buildEnv(options) {
  */
 async function drainToEof(stream, signal) {
     const reader = stream.getReader();
-    const decoder = new TextDecoder();
-    let text = "";
+    const capture = new BoundedCapture(_argvExecDeps.streamCaptureBytes);
     const onAbort = () => {
         // Closing the stream forces the in-flight `read()` below to resolve with
-        // `{done: true}`; any bytes already captured stay in `text`.
+        // `{done: true}`; any bytes already captured stay in `capture`.
         reader.cancel().catch(() => {
             // Cancelling after the pipe already closed is a no-op race; ignore.
         });
@@ -91,15 +101,14 @@ async function drainToEof(stream, signal) {
             if (done === true)
                 break;
             if (value !== undefined)
-                text += decoder.decode(value, { stream: true });
+                capture.push(value);
         }
     }
     catch {
         // Stream cancelled by SIGKILL on the process group; the partial text
-        // is still in `text`, so resolve with closed=false and let the caller
+        // is still in `capture`, so resolve with what it holds and let the caller
         // decide.
     }
-    text += decoder.decode();
     if (signal !== undefined)
         signal.removeEventListener("abort", onAbort);
     try {
@@ -108,7 +117,63 @@ async function drainToEof(stream, signal) {
     catch {
         // Already released; nothing to do.
     }
-    return { text, closed: true };
+    return { text: capture.text(), closed: true };
+}
+/**
+ * Keeps the first and the last `maxBytes / 2` bytes of a stream and counts what falls between
+ * (STREAM_CAPTURE_BYTES). The head is decoded as it arrives; the tail is kept as bytes, trimmed from
+ * the front, and decoded once at the end from a codepoint boundary.
+ */
+class BoundedCapture {
+    half;
+    decoder = new TextDecoder();
+    head = "";
+    headBytes = 0;
+    tail = [];
+    tailBytes = 0;
+    omitted = 0;
+    constructor(maxBytes) {
+        this.half = Math.max(1, Math.floor(maxBytes / 2));
+    }
+    push(chunk) {
+        let rest = chunk;
+        if (this.headBytes < this.half) {
+            const take = Math.min(this.half - this.headBytes, rest.length);
+            this.head += this.decoder.decode(rest.subarray(0, take), { stream: true });
+            this.headBytes += take;
+            rest = rest.subarray(take);
+        }
+        if (rest.length === 0)
+            return;
+        this.tail.push(rest);
+        this.tailBytes += rest.length;
+        while (this.tailBytes > this.half) {
+            const first = this.tail[0];
+            const excess = this.tailBytes - this.half;
+            if (first.length <= excess) {
+                this.tail.shift();
+                this.tailBytes -= first.length;
+                this.omitted += first.length;
+            }
+            else {
+                this.tail[0] = first.subarray(excess);
+                this.tailBytes -= excess;
+                this.omitted += excess;
+            }
+        }
+    }
+    text() {
+        const tail = Buffer.concat(this.tail);
+        if (this.omitted === 0)
+            return this.head + this.decoder.decode(tail);
+        // The cut can land inside a codepoint: skip its continuation bytes so the tail opens cleanly.
+        let start = 0;
+        while (start < tail.length && (tail[start] & 0xc0) === 0x80)
+            start += 1;
+        const head = this.head + this.decoder.decode();
+        const marker = `\n[... ${this.omitted + start} bytes of output omitted ...]\n`;
+        return head + marker + new TextDecoder().decode(tail.subarray(start));
+    }
 }
 export async function runArgv(options) {
     const signal = options.signal;

package/dist/mcp/connect.js

@@ -6,7 +6,8 @@
  * once the process is gone. A failed connect is closed the same way.
  */
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
+import { ErrorCode, ListToolsResultSchema, McpError, ToolSchema } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
 import { McpCallError, McpConnectError } from "#src/mcp/errors";
 import { resultText } from "#src/mcp/result-text";
 import { waitForStdioExit } from "#src/mcp/stdio-close";
@@ -53,13 +54,35 @@ function toolInfo(raw) {
     if (!isRaw(raw) || typeof raw.name !== "string" || raw.name.length === 0)
         return undefined;
     const inputSchema = isRaw(raw.inputSchema) ? { ...raw.inputSchema } : {};
-    return { name: raw.name, description: typeof raw.description === "string" ? raw.description : "", inputSchema };
+    const readOnly = isRaw(raw.annotations) && raw.annotations.readOnlyHint === true;
+    return {
+        name: raw.name,
+        description: typeof raw.description === "string" ? raw.description : "",
+        inputSchema,
+        ...(readOnly ? { readOnly: true } : {}),
+    };
+}
+/**
+ * The SDK's own tools/list schema, except that a tool's `annotations` are not
+ * type-checked: the SDK would reject the WHOLE page over one server's
+ * `readOnlyHint: "yes"`, which would cost the connection every tool. `toolInfo`
+ * reads the hint strictly (`=== true`), so a malformed one just means "not
+ * read-only" and every other field is still validated.
+ */
+const LenientListToolsSchema = ListToolsResultSchema.extend({
+    tools: z.array(ToolSchema.extend({ annotations: z.record(z.string(), z.unknown()).optional() })),
+});
+async function listPage(client, cursor, signal, timeout) {
+    const page = await client.request({ method: "tools/list", ...(cursor !== undefined ? { params: { cursor } } : {}) }, LenientListToolsSchema, { signal, timeout });
+    // What Client.listTools does after its own request: the SDK reads these caches in callTool.
+    client["cacheToolMetadata"](page.tools);
+    return page;
 }
 async function listAll(client, signal, timeout) {
     const tools = [];
     let cursor;
     do {
-        const page = await client.listTools(cursor !== undefined ? { cursor } : undefined, { signal, timeout });
+        const page = await listPage(client, cursor, signal, timeout);
         for (const raw of page.tools ?? []) {
             const info = toolInfo(raw);
             if (info !== undefined)

package/dist/mcp/types.d.ts

@@ -15,6 +15,13 @@ export interface McpToolInfo {
     readonly name: string;
     readonly description: string;
     readonly inputSchema: JSONSchema;
+    /**
+     * Present (as `true`) only when the server annotated the tool
+     * `readOnlyHint: true`. Absent in every other case, so an unannotated tool
+     * keeps its `{ name, description, inputSchema }` shape. Trusted as the server
+     * states it; the lock pins input schemas, not this hint.
+     */
+    readonly readOnly?: true;
 }
 export interface McpCallResult {
     readonly text: string;

package/dist/native/models.js

@@ -117,6 +117,7 @@ export function toProviderOverrides(overrides) {
             // Omitted when the override declares none: nax-ai then falls back to the
             // template sibling's ceiling, which is the only honest value available.
             ...(model.maxTokens !== undefined ? { maxTokens: model.maxTokens } : {}),
+            ...(model.thinkingFormat !== undefined ? { thinkingFormat: model.thinkingFormat } : {}),
             supportsTools: model.supportsTools,
             thinkingLevels: model.thinkingLevels,
             // nax#2191: forwarded verbatim. nax-ai's `assertOverrideModelRouting`

package/dist/native/session/loop-events/types.d.ts

@@ -128,6 +128,11 @@ export interface BeforeRequestPatch {
  * parameter, not a new concept.
  */
 export interface CompleteCallOptions {
+    /**
+     * `false` asks for no thinking on this request; on a model that cannot
+     * disable thinking it gets the least thinking the model supports instead.
+     * `true` keeps the session's resolved level.
+     */
     readonly thinking?: boolean;
     readonly temperature?: number;
 }

package/dist/native/session-adapter.js

@@ -271,6 +271,12 @@ export class NativeSessionAdapter {
                             messages: [...span, { role: "user", content: summaryPrompt(previousSummary) }],
                             sessionId,
                             signal,
+                            // A summary restates the transcript; it does not need reasoning.
+                            // "off", not an absent level: absent means the backend default,
+                            // which on a model that cannot disable thinking is adaptive at
+                            // effort high (#2686). The client clamps "off" to the least
+                            // thinking such a model allows.
+                            thinking: "off",
                         });
                         const summaryUsage = res.usage;
                         const { costUsd, resolvedRates } = priceCall(summaryUsage, rates);
@@ -299,11 +305,16 @@ export class NativeSessionAdapter {
                     const signal = AbortSignal.any(opts.signal !== undefined
                         ? [opts.signal, controller.signal, turnController.signal, deadlineController.signal]
                         : [controller.signal, turnController.signal, deadlineController.signal]);
-                    // The loop-event bag speaks in booleans: `false` explicitly drops
-                    // the session's inherited thinking level for this request, while
-                    // `true` leaves that resolved level in place. nax-ai accepts a
-                    // thinking LEVEL rather than a boolean, so normalize at this boundary.
-                    const requestThinking = requestOptions?.thinking === false ? undefined : thinking;
+                    // The loop-event bag speaks in booleans: `false` turns thinking off
+                    // for this request, while `true` leaves the session's resolved level
+                    // in place. nax-ai accepts a thinking LEVEL rather than a boolean, so
+                    // normalize at this boundary. `false` must become "off", not an
+                    // absent level: absent means the backend default, which on a model
+                    // that cannot disable thinking is adaptive at effort high (#2686).
+                    // nax-ai clamps "off" to the lowest level such a model supports, so
+                    // there `false` still enables thinking, and a `temperature` set
+                    // alongside it is dropped by the backend as for any thinking request.
+                    const requestThinking = requestOptions?.thinking === false ? "off" : thinking;
                     try {
                         instructionInteraction.acknowledge();
                         const res = await billedOnFailure(rates, () => streamComplete(client, resolved, {

package/dist/permissions/approval-memory.d.ts

@@ -0,0 +1,18 @@
+/** Shared session approval-memory policy, ported from the ACP server (nax#2553). */
+export interface ApprovalMemoryRequest {
+    readonly tool: string;
+    readonly command?: string;
+}
+export type ApprovalMemoryDecision = "allow" | "deny";
+/**
+ * Tool key, or execute tool plus command/subcommand. Unsafe, masked, wrapper and
+ * flag-second-word requests have no key. A key alone never authorizes a command:
+ * callers must also check approvalMemoryApplies against the remembered decision.
+ */
+export declare function approvalMemoryKey(request: ApprovalMemoryRequest): string | undefined;
+/**
+ * Whether a decision found under this request's key may answer without asking.
+ * Allows cover only simple commands with plain, non-flag words after the key;
+ * denies cover their matching key regardless. Does not validate key eligibility.
+ */
+export declare function approvalMemoryApplies(request: ApprovalMemoryRequest, decision: ApprovalMemoryDecision): boolean;

package/dist/permissions/approval-memory.js

@@ -0,0 +1,88 @@
+/** Keep aligned with the ACP display's execute tools, without depending on that transport. */
+const APPROVAL_EXECUTE_TOOLS = new Set(["Bash", "RunCommand", "Git", "GitCommit"]);
+/** Chaining, pipes, substitution, subshells, redirection and line breaks. */
+const SHELL_METACHARACTERS = /[;&|`$()<>\n\r]/;
+/** First words that run another command or arbitrary code. */
+const WRAPPERS = new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ksh",
+    "fish",
+    "env",
+    "xargs",
+    "sudo",
+    "doas",
+    "su",
+    "command",
+    "builtin",
+    "eval",
+    "exec",
+    "source",
+    ".",
+    "nohup",
+    "time",
+    "timeout",
+    "nice",
+    "ionice",
+    "stdbuf",
+    "watch",
+    "find",
+    "node",
+    "bun",
+    "deno",
+    "npx",
+    "bunx",
+    "pnpx",
+    "python",
+    "python3",
+    "perl",
+    "ruby",
+    "php",
+    "uv",
+    "uvx",
+]);
+/** A plain command name or path: no quotes, escapes, globs or expansions the shell would rewrite. */
+const PLAIN_WORD = /^[A-Za-z0-9._/-]+$/;
+/** The masking prefix S3 puts in place of a secret in a shown command. */
+const MASK_MARKER = "[REDACTED";
+/**
+ * Tool key, or execute tool plus command/subcommand. Unsafe, masked, wrapper and
+ * flag-second-word requests have no key. A key alone never authorizes a command:
+ * callers must also check approvalMemoryApplies against the remembered decision.
+ */
+export function approvalMemoryKey(request) {
+    if (!APPROVAL_EXECUTE_TOOLS.has(request.tool))
+        return request.tool;
+    const command = request.command ?? "";
+    if (command.includes(MASK_MARKER))
+        return undefined;
+    const [first = "", second] = command.trim().split(/\s+/);
+    if (!PLAIN_WORD.test(first))
+        return undefined;
+    const name = first.slice(first.lastIndexOf("/") + 1).toLowerCase();
+    if (name === "" || WRAPPERS.has(name))
+        return undefined;
+    if (second === undefined)
+        return `${request.tool}:${first}`;
+    // A flag can change what the command does (`rm -f`, `git -C repo`): remembering the bare command would
+    // approve every later invocation of it, so a flag second word is never remembered (nax#2553).
+    if (second.startsWith("-"))
+        return undefined;
+    return PLAIN_WORD.test(second) ? `${request.tool}:${first} ${second}` : undefined;
+}
+/**
+ * Whether a decision found under this request's key may answer without asking.
+ * Allows cover only simple commands with plain, non-flag words after the key;
+ * denies cover their matching key regardless. Does not validate key eligibility.
+ */
+export function approvalMemoryApplies(request, decision) {
+    if (decision === "deny" || !APPROVAL_EXECUTE_TOOLS.has(request.tool))
+        return true;
+    const command = request.command ?? "";
+    if (SHELL_METACHARACTERS.test(command))
+        return false;
+    const rest = command.trim().split(/\s+/).slice(2);
+    return rest.every((word) => PLAIN_WORD.test(word) && !word.startsWith("-"));
+}

package/dist/permissions/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./approval-audit.ts";
+export { type ApprovalMemoryDecision, type ApprovalMemoryRequest, approvalMemoryApplies, approvalMemoryKey, } from "./approval-memory.ts";
 export * from "./approvals-link.ts";
 export * from "./approvals-store.ts";
 export * from "./approvals-taint.ts";

package/dist/permissions/index.js

@@ -1,4 +1,5 @@
 export * from "./approval-audit.js";
+export { approvalMemoryApplies, approvalMemoryKey, } from "./approval-memory.js";
 export * from "./approvals-link.js";
 export * from "./approvals-store.js";
 export * from "./approvals-taint.js";

package/dist/permissions/types.d.ts

@@ -36,6 +36,12 @@ export interface AskRequest {
      * hide shell syntax (review #9). The human link denies without prompting.
      */
     readonly unshowable?: true;
+    /**
+     * US-004: the call wants to run OUTSIDE the OS sandbox (the sandbox is never
+     * turned off for the whole session). A host that keys on it can offer a
+     * distinct decision; one that ignores it shows the ordinary approval prompt.
+     */
+    readonly unsandboxed?: true;
     /** The permitted root -- where the shell actually starts (src/tools/bash.ts:165). */
     readonly root?: string;
     /** The verdict's original reason, NOT rewritten as `matched ask rule "..."`. */

package/dist/sandbox/claude-settings.d.ts

@@ -41,6 +41,7 @@ export declare const CLAUDE_SETTINGS_FILES: readonly string[];
  * policy compile time, so a symlink created mid-session is still seen.
  *
  * Segment-exact on the full path — a sibling such as `settings.json.bak`, or any
- * other file under `.claude/`, is an ordinary path a tool must still reach.
+ * other file under `.claude/`, is an ordinary path a tool must still reach. The
+ * compare ignores case: `.Claude/settings.json` is the same file on macOS and Windows.
  */
 export declare function claudeSettingsWriteRefusal(tool: string, rel: string, resolvedRoot: string): string | undefined;

package/dist/sandbox/claude-settings.js

@@ -53,15 +53,19 @@ const CLAUDE_SETTINGS_WRITE_TOOLS = new Set(["Write", "Edit", "Delete"]);
  * policy compile time, so a symlink created mid-session is still seen.
  *
  * Segment-exact on the full path — a sibling such as `settings.json.bak`, or any
- * other file under `.claude/`, is an ordinary path a tool must still reach.
+ * other file under `.claude/`, is an ordinary path a tool must still reach. The
+ * compare ignores case: `.Claude/settings.json` is the same file on macOS and Windows.
  */
 export function claudeSettingsWriteRefusal(tool, rel, resolvedRoot) {
     if (!CLAUDE_SETTINGS_WRITE_TOOLS.has(tool))
         return undefined;
-    const entry = CLAUDE_SETTINGS_FILES.find((e) => e === rel || resolvedSettingsRel(resolvedRoot, e) === rel);
+    // Case-folded for the same reason as the `.git/` ban: on a case-insensitive filesystem
+    // `.Claude/settings.json` is the settings file, under a spelling a literal compare misses.
+    const folded = rel.toLowerCase();
+    const entry = CLAUDE_SETTINGS_FILES.find((e) => e.toLowerCase() === folded || resolvedSettingsRel(resolvedRoot, e).toLowerCase() === folded);
     if (entry === undefined)
         return undefined;
-    const subject = entry === rel
+    const subject = entry.toLowerCase() === folded
         ? `"${rel}" is a Claude Code settings file`
         : `"${rel}" is the target of the Claude Code settings file "${entry}"`;
     return (`${subject}: Claude loads allow rules, hooks and MCP servers from it for every ` +

package/dist/sandbox/defaults.js

@@ -44,4 +44,5 @@ export const BUILTIN_CREDENTIAL_READ_DENIES = [
     ".pypirc",
     ".git-credentials",
     ".config/gh",
+    ".config/glab-cli",
 ];