@nathapp/nax 0.82.0-canary.9 → 0.82.1

package/CHANGELOG.md

@@ -13,14 +13,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Breaking
 
 - `autoMode.defaultAgent`, `autoMode.fallbackOrder`, and `context.v2.fallback` config fields removed. Use `agent.default` and `agent.fallback.map` instead (ADR-012 Phase 6). Loading a config containing any of these keys throws `NaxError CONFIG_LEGACY_AGENT_KEYS` with a per-key migration pointer.
+- **BREAKING (custom permission profiles only):** the agent's file-tool containment root moved from the
+  story's package directory to the repo root (single-frame redesign). A custom `scoped` permission
+  profile's grant globs (e.g. `Write(src/**)`) now match against REPO-ROOTED paths instead of
+  package-relative paths — `Write(src/**)` that used to scope a grant to the package's own `src/` now
+  matches `src/**` at the repo root only; a monorepo profile author who wants the old scoping must
+  rewrite the glob as `Write(packages/*/src/**)` or the specific package path. The default `unrestricted`
+  profile is unaffected (it skips glob matching entirely). No config schema change; this is a semantic
+  shift in what an existing glob string matches.
 
 ### Fixed
 
 - **watchdog:** Count ACP `tool_call` / `tool_call_update` stream activity by default, and add `agent.idleWatchdog.toolCallOnlyIdleTimeoutSeconds` (default 1800s) so long-running tool-only sessions stay alive without masking runaway tool loops.
+- **Story fragments no longer name nax's own artifacts.** The fragment collector (`## Files touched`) ran
+  `git diff --name-only` with no exclusions, so git-tracked run state such as
+  `<pkg>/.nax/cache/test-patterns.json` was recorded as a changed file and then offered to a dependent
+  story as something worth reading. Excludes are anchored at the repository root, so the same fragment is
+  produced whether the story's workdir is the repo root or a package (#2072).
+- **Monorepo: the agent loop now uses per-package config.** `callOp` resolved its config from the repo
+  root, so a story with a `workdir` was given the ROOT `quality.commands` and `RunCommand` ran the wrong
+  toolchain (#2066). The registry also missed every override under worktree and parallel isolation, where
+  a package resolved through `.nax-wt/<storyId>/` (#2069).
+
+  **Behaviour change:** `execution.permissionProfile` and `execution.permissions` declared in
+  `.nax/mono/<pkg>/config.json` were previously inert at every dispatch site and now apply, completing the
+  SEC-3 fix. Per-package `execution.denyPaths`, `models`, `agent.native.transportRetry` and
+  `execution.compaction` likewise now take effect. If an overlay in your repo sets any of these, review it
+  before upgrading — the resolved profile is now logged once per dispatch.
+  - **RunCommand:** `target` supplied with a declared `command` is now rejected (previously the `target`
+    was silently discarded); `target` remains valid only for the `argv` branch (#2066).
+  - **Review diff paths are now package-relative.** `collectDiff`, `collectDiffStat` and
+    `computeTestInventory` ran git without `--relative`, so a monorepo story's reviewer — whose file
+    tools are rooted at the package dir — was shown repo-rooted paths like `packages/lib/src/util.ts`.
+    Reading one resolved to `<pkg>/packages/lib/...` and failed, costing a round trip per file before
+    the model retried. `computeTestInventory` also gained the `-- .` pathspec its siblings already had,
+    so the adversarial prompt's test-gap inventory no longer lists files from other packages (#2066).
 - **Fixed** — a same-agent fallback hop dispatched the previous model, because
   `SessionManager` reused a live session whenever the agent name matched and
   discarded the requested endpoint. Same-agent ladder rungs and sticky endpoints
   inherited by warm rectification ops were both inert (#1965).
+- `nax plan --decompose` now persists through `finalizeAndWritePrd` instead of writing the PRD raw, so decompose-created sub-stories get `workdirSource` stamped and their declared paths re-spelled into the repo frame (#2080). The write is scoped to the new sub-stories: workdir derivation and routing resolution do not re-run over stories already in the PRD, which may have executed.
 
 ### Changed
 

package/README.md

@@ -120,11 +120,34 @@ For full flag details, see the [CLI Reference](docs/guides/cli-reference.md).
     "hooks": {
       "on-all-stories-complete": { "command": "npm run build" }  // Fire after all stories pass
     }
+  },
+  "mcp": {
+    "servers": {
+      "codebase-memory": {
+        "command": "codebase-memory-mcp",     // stdio MCP server binary (client only)
+        "args": [],                            // Optional server args
+        "stages": ["run"],                     // Attach in these pipeline stages ("*" = all)
+        "allowedTools": ["search_graph"]       // Optional: subset of locked tools that is grantable
+      }
+    }
+  },
+  "execution": {
+    "commandInterceptor": {
+      "provider": "rtk",                       // Token-reducing proxy for the Git tool
+      "enabled": true,                         // Off by default — opt in per project
+      "git": { "verbs": ["log", "diff"] }      // Only these subcommands are rewritten
+    }
   }
 }
 ```
 
-See [Configuration Guide](docs/guides/configuration.md) for the full schema.
+`mcp` attaches external Model Context Protocol (MCP) servers as tool providers — nax is a client only, never an MCP server. The server id is the tool-name namespace: the `codebase-memory` server advertises its tools as `codebase-memory__search_graph`, `codebase-memory__trace_path`, and so on. Before any of those tools are grantable, run `nax mcp lock` at the project root: it connects every enabled server once, pins the advertised tool surface (name + input-schema hash) to `.nax/mcp-lock.json`, and that lockfile is committed like `bun.lock`. `stages` is the attachment control — a server's tools attach only to the listed pipeline stages, and an empty list attaches nowhere. MCP tools are advertised under the `unrestricted` permission profile only; `safe` and `scoped` resolve no provider tools at all. `allowedTools` narrows which locked tools are grantable; omitted means every locked tool is.
+
+`execution.commandInterceptor` rewrites the `Git` tool's argv through `rtk` so `log` and `diff` output reaches the model compressed. It is confined to the Git site: user-authored `quality.commands` and `acceptance.command` are never wrapped. It fails open — if the `rtk` binary is missing the call runs as plain git.
+
+**Both features are native-agent only.** An ACP agent (`claude`, `codex`, `opencode`, `gemini`) brings its own tools, so nax's `Git` tool is never invoked and no MCP tool is advertised. A project on `"protocol": "acp"` can hold a complete, valid config for both and get zero effect, with no error. The built-in defaults (`agent.protocol: "hybrid"`, `agent.default: "native"`) enable both; a config that switches to an acpx agent does not.
+
+See [MCP & Command Interception](docs/guides/mcp-and-interception.md) for setup, verification and troubleshooting, and the [Configuration Guide](docs/guides/configuration.md) for the full schema.
 
 ---
 
@@ -186,11 +209,12 @@ See [Plugins Guide](docs/guides/agents.md#plugins).
 
 ## Agents
 
-nax communicates with all coding agents via [ACP](https://github.com/openclaw/acpx) (Agent Client Protocol) — a JSON-RPC protocol that provides persistent sessions, exact token/cost reporting, and multi-turn session continuity.
+The default agent is `native`: nax drives the model in-process over `@nathapp/nax-ai` (no CLI binary), using the built-in `models.native` Anthropic tier map, so it needs Anthropic credentials (`nax auth` or the provider's environment variable) unless you override the map. Every other agent is reached via [ACP](https://github.com/openclaw/acpx) (Agent Client Protocol) — a JSON-RPC protocol that provides persistent sessions, exact token/cost reporting, and multi-turn session continuity.
 
 | Agent | Binary | Notes |
 |:------|:-------|:------|
-| Claude Code | `claude` | Default. Set `agent.default: "claude"` |
+| Native (nax-ai) | — (in-process) | Default. `agent.default: "native"` |
+| Claude Code | `claude` | Set `agent.default: "claude"` |
 | OpenCode | `opencode` | Set `agent.default: "opencode"` |
 | Codex | `codex` | Set `agent.default: "codex"` |
 | Gemini CLI | `gemini` | Set `agent.default: "gemini"` |