@nathapp/nax-agent 0.91.7 → 0.91.8-canary.2

package/dist/tools/ask-request.js

@@ -17,6 +17,14 @@ export const MAX_ASK_SUMMARY_CHARS = 200;
  * a Write, a commit message, whatever a provider tool takes -- and an
  * AskResolver is by definition an outbound channel to a human. A summary is
  * what approval needs; the payload is what the audit sink already holds.
+ *
+ * Two kinds of declared field, and only these: the parts that say WHAT the
+ * call will do (command, argv, verb, paths), and the summary-only fields a tool
+ * adds for legibility (`ToolScope.summaryFields`) -- a memory tool's `slug`,
+ * so the person reads which note is about to be written instead of the same
+ * line the tool always rendered. Neither kind is grant-checked here, and
+ * neither is ever widened into the payload: a summary field renders only a
+ * string, number or boolean.
  */
 export function askSummary(tool, scope, input) {
     const fields = [scope.commandField, scope.argvField, scope.verbField, ...scope.pathFields];
@@ -30,13 +38,38 @@ export function askSummary(tool, scope, input) {
             return [`${field}=${value.filter((v) => typeof v === "string").join(" ")}`];
         return [];
     });
+    // Summary fields FOLLOW the parts above, so a path-bearing tool keeps its
+    // existing line and gains the extra detail at the end.
+    const summaryParts = (scope.summaryFields ?? []).flatMap((field) => {
+        const rendered = summaryScalar(input[field]);
+        return rendered === undefined ? [] : [`${field}=${rendered}`];
+    });
     // Mask the FULL line, then cut: cutting first can split a secret so no
     // pattern matches what is left, and the partial secret would go out.
-    const masked = maskForPrompt(`${tool} ${parts.join(" ")}`.trim());
+    const masked = maskForPrompt(`${tool} ${[...parts, ...summaryParts].join(" ")}`.trim());
     if (!masked.ok)
         return { summary: `${tool} [arguments withheld: contains a secret]`, unshowable: true };
     return { summary: masked.masked.slice(0, MAX_ASK_SUMMARY_CHARS), unshowable: false };
 }
+/** One line break, whichever convention wrote it: CRLF before CR and LF alone. */
+const SUMMARY_LINE_BREAK = /\r\n|\r|\n/g;
+/**
+ * The one-line form of a summary field's value, or undefined when the value is
+ * not renderable.
+ *
+ * Scalars only. An array or an object is SKIPPED rather than serialised: a
+ * summary line describes the call, and a serialised payload on it would be the
+ * very thing this function exists to avoid. A line break inside a value
+ * becomes one space, because the line is a single line -- an unstripped newline
+ * would let a field forge a second line of the approval card.
+ */
+function summaryScalar(value) {
+    if (typeof value === "string")
+        return value.replace(SUMMARY_LINE_BREAK, " ");
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return undefined;
+}
 /** The clause `unsandboxedReasonSuffix` renders, before the reason itself. */
 const UNSANDBOXED_PREFIX = " -- runs OUTSIDE the sandbox: ";
 /** What the suffix says when the model gave no usable reason. */

package/dist/tools/provider-adapt.js

@@ -26,7 +26,11 @@ export function adaptProviderTool(providerId, tool) {
         inputSchema: tool.inputSchema,
         // No path fields and no verb field: the grant lookup is the whole gate,
         // which is the honest expression for a tool whose arguments are not paths.
-        scope: { pathFields: [] },
+        // A declared summary field is carried through, summary-only — it names the
+        // call on an approval line and is never checked. Absent, the scope stays
+        // exactly `{ pathFields: [] }`, so a metadata-free provider tool adapts to
+        // the same shape it always did.
+        scope: tool.summaryFields === undefined ? { pathFields: [] } : { pathFields: [], summaryFields: tool.summaryFields },
         run: (input, ctx) => tool.run(input, ctx),
     };
 }

package/dist/tools/provider-types.d.ts

@@ -24,6 +24,13 @@ export interface ProviderTool {
      * trusted as stated and decides whether an ask-profile session asks first.
      */
     readonly readOnly?: boolean;
+    /**
+     * US-003: plain input fields an approval line may SHOW, copied verbatim into
+     * the adapted tool's `scope.summaryFields`. Summary-only — never grant-checked
+     * and never rendered as a path (see `ToolScope.summaryFields`). Absent for
+     * every memory tool's note BODY, which is never shown on an approval line.
+     */
+    readonly summaryFields?: readonly string[];
     run(input: Record<string, unknown>, ctx: ToolRunContext): Promise<ToolResult>;
 }
 export interface ToolProvider {

package/dist/tools/types.d.ts

@@ -118,6 +118,22 @@ export interface ToolScope {
      * option, and whether a call is PERMITTED is the runtime's decision.
      */
     readonly unsandboxedField?: string;
+    /**
+     * Plain input fields an approval line may SHOW, in declaration order
+     * (`askSummary`). Summary-only in the strictest sense: they are never
+     * grant-checked, never resolved as paths, never treated as a verb or a
+     * command, and never widen what an approval admits. They exist because a
+     * tool whose arguments are not paths — an MCP memory tool, say — otherwise
+     * renders an approval line naming nothing about the call.
+     *
+     * Only a string, number or boolean value is rendered (line breaks flattened
+     * to a space); an array or an object is skipped rather than serialised, since
+     * a summary is a one-line description and not a payload dump. Being
+     * summary-only, this field is deliberately absent from `isFieldlessScope`
+     * (policy.ts): a tool declaring summary fields is still fieldless, so an
+     * unconditional ask rule keeps asking exactly as it did before.
+     */
+    readonly summaryFields?: readonly string[];
 }
 /**
  * `breach` separates "you may not write there" from "that path is not in this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax-agent",
-  "version": "0.91.7",
+  "version": "0.91.8-canary.2",
   "description": "nax's native coding agent: session contract, native loop, tools, permissions, sandbox, command-safety.",
   "license": "MIT",
   "author": "William Khoo",
@@ -47,13 +47,13 @@
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.77",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nathapp/nax-ai": "0.91.7",
-    "zod": "^4.3.6"
+    "@nathapp/nax-ai": "0.91.8-canary.2",
+    "zod": "^4.6.6"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
     "provenance": true,
-    "tag": "latest"
+    "tag": "canary"
   }
 }