@nathapp/nax 0.82.0-canary.7 → 0.82.0

package/CHANGELOG.md

@@ -13,10 +13,86 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Breaking
 
 - `autoMode.defaultAgent`, `autoMode.fallbackOrder`, and `context.v2.fallback` config fields removed. Use `agent.default` and `agent.fallback.map` instead (ADR-012 Phase 6). Loading a config containing any of these keys throws `NaxError CONFIG_LEGACY_AGENT_KEYS` with a per-key migration pointer.
+- **BREAKING (custom permission profiles only):** the agent's file-tool containment root moved from the
+  story's package directory to the repo root (single-frame redesign). A custom `scoped` permission
+  profile's grant globs (e.g. `Write(src/**)`) now match against REPO-ROOTED paths instead of
+  package-relative paths — `Write(src/**)` that used to scope a grant to the package's own `src/` now
+  matches `src/**` at the repo root only; a monorepo profile author who wants the old scoping must
+  rewrite the glob as `Write(packages/*/src/**)` or the specific package path. The default `unrestricted`
+  profile is unaffected (it skips glob matching entirely). No config schema change; this is a semantic
+  shift in what an existing glob string matches.
 
 ### Fixed
 
 - **watchdog:** Count ACP `tool_call` / `tool_call_update` stream activity by default, and add `agent.idleWatchdog.toolCallOnlyIdleTimeoutSeconds` (default 1800s) so long-running tool-only sessions stay alive without masking runaway tool loops.
+- **Story fragments no longer name nax's own artifacts.** The fragment collector (`## Files touched`) ran
+  `git diff --name-only` with no exclusions, so git-tracked run state such as
+  `<pkg>/.nax/cache/test-patterns.json` was recorded as a changed file and then offered to a dependent
+  story as something worth reading. Excludes are anchored at the repository root, so the same fragment is
+  produced whether the story's workdir is the repo root or a package (#2072).
+- **Monorepo: the agent loop now uses per-package config.** `callOp` resolved its config from the repo
+  root, so a story with a `workdir` was given the ROOT `quality.commands` and `RunCommand` ran the wrong
+  toolchain (#2066). The registry also missed every override under worktree and parallel isolation, where
+  a package resolved through `.nax-wt/<storyId>/` (#2069).
+
+  **Behaviour change:** `execution.permissionProfile` and `execution.permissions` declared in
+  `.nax/mono/<pkg>/config.json` were previously inert at every dispatch site and now apply, completing the
+  SEC-3 fix. Per-package `execution.denyPaths`, `models`, `agent.native.transportRetry` and
+  `execution.compaction` likewise now take effect. If an overlay in your repo sets any of these, review it
+  before upgrading — the resolved profile is now logged once per dispatch.
+  - **RunCommand:** `target` supplied with a declared `command` is now rejected (previously the `target`
+    was silently discarded); `target` remains valid only for the `argv` branch (#2066).
+  - **Review diff paths are now package-relative.** `collectDiff`, `collectDiffStat` and
+    `computeTestInventory` ran git without `--relative`, so a monorepo story's reviewer — whose file
+    tools are rooted at the package dir — was shown repo-rooted paths like `packages/lib/src/util.ts`.
+    Reading one resolved to `<pkg>/packages/lib/...` and failed, costing a round trip per file before
+    the model retried. `computeTestInventory` also gained the `-- .` pathspec its siblings already had,
+    so the adversarial prompt's test-gap inventory no longer lists files from other packages (#2066).
+- **Fixed** — a same-agent fallback hop dispatched the previous model, because
+  `SessionManager` reused a live session whenever the agent name matched and
+  discarded the requested endpoint. Same-agent ladder rungs and sticky endpoints
+  inherited by warm rectification ops were both inert (#1965).
+- `nax plan --decompose` now persists through `finalizeAndWritePrd` instead of writing the PRD raw, so decompose-created sub-stories get `workdirSource` stamped and their declared paths re-spelled into the repo frame (#2080). The write is scoped to the new sub-stories: workdir derivation and routing resolution do not re-run over stories already in the PRD, which may have executed.
+
+### Changed
+
+- **Changed** — `agent.fallback.maxHopsPerStory` now bounds ladder DEPTH per
+  (story, tier, agent, role) rather than counting swap events per story, so a
+  story keeps descending its ladder across its operations instead of stranding
+  later ops on a dead endpoint.
+
+### Added
+
+- **Added** — `agent.fallback.map` agents are validated against `agent.protocol`
+  at config load instead of failing mid-story at dispatch.
+
+### Fixed
+
+- **Fixed** — `resolveFallbackModelId` resolved a literal model pin in
+  preference to a co-present tier, so a cooldown recorded at mark time
+  (`markUnavailable(agent, failure, tier, dispatchedModel)`, where `tier` is
+  declared and `dispatchedModel` is the hop's derived endpoint) and a
+  candidate lookup at read time (a bare `{agent, tier}` rung, no model) could
+  key on different identities for the same endpoint — a rung that just died
+  could read back as healthy. Precedence is now tier-first: when a tier is
+  present and `models` is available, the tier map is authoritative, and the
+  pin is used only when there is no tier, or the tier fails to resolve.
+- **Fixed** — `AgentManager.configureRuntime` silently dropped `models`. An
+  `AgentManager` injected via `opts.agentManager` in `runtime/index.ts` (which
+  spreads `models: config.models` into `configureRuntime`) never had its
+  `_models` backfilled, so `resolveFallbackModelId` returned `undefined` for
+  every tier and a rung like `{agent: "native", model: "powerful"}` never
+  folded to its named tier — it dispatched the literal string `"powerful"` as
+  a model id, with no error and no log. `configureRuntime` now accepts
+  `models` and assigns it with the same guard style as its siblings.
+
+### Migration
+
+- **Migration** — a config that names an agent in `agent.fallback.map` which the
+  declared `agent.protocol` does not permit is now rejected at config load
+  rather than failing mid-story with `AGENT_NOT_FOUND`. A ladder mixing
+  `native` with acpx agents requires `agent.protocol: "hybrid"`; previously
+  such a config parsed and failed later, at dispatch.
 
 ## [0.51.2] — 2026-03-22
 

package/README.md

@@ -120,11 +120,34 @@ For full flag details, see the [CLI Reference](docs/guides/cli-reference.md).
     "hooks": {
       "on-all-stories-complete": { "command": "npm run build" }  // Fire after all stories pass
     }
+  },
+  "mcp": {
+    "servers": {
+      "codebase-memory": {
+        "command": "codebase-memory-mcp",     // stdio MCP server binary (client only)
+        "args": [],                            // Optional server args
+        "stages": ["run"],                     // Attach in these pipeline stages ("*" = all)
+        "allowedTools": ["search_graph"]       // Optional: subset of locked tools that is grantable
+      }
+    }
+  },
+  "execution": {
+    "commandInterceptor": {
+      "provider": "rtk",                       // Token-reducing proxy for the Git tool
+      "enabled": true,                         // Off by default — opt in per project
+      "git": { "verbs": ["log", "diff"] }      // Only these subcommands are rewritten
+    }
   }
 }
 ```
 
-See [Configuration Guide](docs/guides/configuration.md) for the full schema.
+`mcp` attaches external Model Context Protocol (MCP) servers as tool providers — nax is a client only, never an MCP server. The server id is the tool-name namespace: the `codebase-memory` server advertises its tools as `codebase-memory__search_graph`, `codebase-memory__trace_path`, and so on. Before any of those tools are grantable, run `nax mcp lock` at the project root: it connects every enabled server once, pins the advertised tool surface (name + input-schema hash) to `.nax/mcp-lock.json`, and that lockfile is committed like `bun.lock`. `stages` is the attachment control — a server's tools attach only to the listed pipeline stages, and an empty list attaches nowhere. MCP tools are advertised under the `unrestricted` permission profile only; `safe` and `scoped` resolve no provider tools at all. `allowedTools` narrows which locked tools are grantable; omitted means every locked tool is.
+
+`execution.commandInterceptor` rewrites the `Git` tool's argv through `rtk` so `log` and `diff` output reaches the model compressed. It is confined to the Git site: user-authored `quality.commands` and `acceptance.command` are never wrapped. It fails open — if the `rtk` binary is missing the call runs as plain git.
+
+**Both features are native-agent only.** An ACP agent (`claude`, `codex`, `opencode`, `gemini`) brings its own tools, so nax's `Git` tool is never invoked and no MCP tool is advertised. A project on `"protocol": "acp"` can hold a complete, valid config for both and get zero effect, with no error. Set `agent.protocol: "hybrid"` and `agent.default: "native"` first.
+
+See [MCP & Command Interception](docs/guides/mcp-and-interception.md) for setup, verification and troubleshooting, and the [Configuration Guide](docs/guides/configuration.md) for the full schema.
 
 ---