@sagentlab/navarch-runtime 0.1.1 → 0.1.3

package/dist/cli.cjs

@@ -29,6 +29,15 @@ function invocation(subcommand) {
     const prefix = viaNpx ? `npx ${PACKAGE_NAME}` : "navarch-runtime";
     return `${prefix} ${subcommand}`;
 }
+function agentFromFlag(flags) {
+    const value = flags.agent;
+    if (value === undefined)
+        return undefined;
+    if (!(0, config_cjs_1.isRuntimeAgentType)(value)) {
+        throw new Error("--agent must be either 'claude-code' or 'codex'.");
+    }
+    return value;
+}
 function parseArgs(argv) {
     const [command, ...rest] = argv;
     const flags = {};
@@ -70,6 +79,7 @@ async function registerCommand(flags) {
         .map((s) => s.trim())
         .filter(Boolean);
     const ownerZone = flags["owner-zone"] ?? config.ownerZone;
+    const agentType = agentFromFlag(flags) ?? config.agentType;
     const client = new api_cjs_1.NavarchApiClient({ baseUrl: apiBase });
     const result = await client.registerMachine({
         enrollment_token: enrollmentToken,
@@ -83,6 +93,7 @@ async function registerCommand(flags) {
         token: result.token,
         name,
         api_base: apiBase,
+        agent_type: agentType,
     });
     // Printed exactly once. Never logged or echoed again after this point.
     console.log("Machine registered.");
@@ -93,8 +104,8 @@ async function registerCommand(flags) {
 /**
  * `navarch-runtime connect` — "Connect an agent to a project"
  * (docs/navarch/schema-design.md §7 "Agent connect"; self-hosted-runner
- * style). The project-scoped sibling of `register`: redeems a short-lived,
- * single-use enrollment token a project owner minted from the platform UI
+ * style). The project-scoped sibling of `register`: redeems a single-use
+ * enrollment token a project owner minted from the platform UI
  * (ConnectAgentPanel → POST /api/projects/:id/enrollment-tokens) instead of
  * the global NAVARCH_ENROLLMENT_SECRET `register` needs. Prints the
  * machine token exactly once, same discipline as `register`.
@@ -116,6 +127,7 @@ async function connectCommand(flags) {
         .split(",")
         .map((s) => s.trim())
         .filter(Boolean);
+    const agentType = agentFromFlag(flags) ?? config.agentType;
     const client = new api_cjs_1.NavarchApiClient({ baseUrl: apiBase });
     const result = await client.connectMachine({
         enrollment_token: enrollmentToken,
@@ -129,6 +141,7 @@ async function connectCommand(flags) {
         token: result.token,
         name,
         api_base: apiBase,
+        agent_type: agentType,
     });
     // Printed exactly once. Never logged or echoed again after this point.
     console.log("Machine connected.");
@@ -136,16 +149,22 @@ async function connectCommand(flags) {
     console.log(`  token:      ${result.token}`);
     console.log(`\nStored in ${config.configDir}/machine.json (mode 0600). Run \`${invocation("start")}\` to begin serving tasks.`);
 }
-async function startCommand() {
-    const config = (0, config_cjs_1.loadRuntimeConfig)();
-    const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(config.configDir, config.apiBase);
+async function startCommand(flags) {
+    const baseConfig = (0, config_cjs_1.loadRuntimeConfig)();
+    const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(baseConfig.configDir, baseConfig.apiBase);
+    // Adapter selection belongs to the local machine: an explicit start flag
+    // wins, followed by NAVARCH_AGENT, the choice saved at connect/register
+    // time, and finally the backwards-compatible Claude Code default.
+    const agentType = agentFromFlag(flags) ??
+        (process.env.NAVARCH_AGENT ? baseConfig.agentType : identity.agent_type ?? baseConfig.agentType);
+    const config = { ...baseConfig, agentType };
     const api = new api_cjs_1.NavarchApiClient({ baseUrl: identity.api_base, token: identity.token });
     const capacity = new capacity_cjs_1.CapacityTracker(config.maxSessions);
     const heartbeat = new heartbeat_loop_cjs_1.MachineHeartbeatLoop(api, identity.machine_id, config, capacity);
     const claimLoop = new claim_loop_cjs_1.ClaimLoop(api, config, capacity, (claimed, sessionId) => (0, session_cjs_1.runSession)({ api, config }, claimed, sessionId));
     heartbeat.start();
     claimLoop.start();
-    log.info(`navarch-runtime started: machine=${identity.name} max_sessions=${config.maxSessions} api_base=${identity.api_base}`);
+    log.info(`navarch-runtime started: machine=${identity.name} agent=${config.agentType} max_sessions=${config.maxSessions} api_base=${identity.api_base}`);
     const shutdown = () => {
         log.info("shutting down...");
         heartbeat.stop();
@@ -155,7 +174,7 @@ async function startCommand() {
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
 }
-async function doctorCommand() {
+async function doctorCommand(flags) {
     const config = (0, config_cjs_1.loadRuntimeConfig)();
     const dockerOk = await (0, sandbox_cjs_1.isDockerAvailable)();
     console.log(`api_base:        ${config.apiBase}`);
@@ -165,23 +184,28 @@ async function doctorCommand() {
     console.log(`capabilities:    ${config.capabilities.join(", ")}`);
     console.log(`sandbox_mode:    ${config.sandboxMode}`);
     console.log(`docker:          ${dockerOk ? "available" : "NOT AVAILABLE (docker-backed sessions will fail)"}`);
+    let identity;
     try {
-        const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(config.configDir, config.apiBase);
-        console.log(`machine:         ${identity.name} (${identity.machine_id})`);
+        identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(config.configDir, config.apiBase);
     }
     catch {
         console.log(`machine:         not registered — run \`${invocation("register")}\``);
+        return;
     }
+    const agentType = agentFromFlag(flags) ??
+        (process.env.NAVARCH_AGENT ? config.agentType : identity.agent_type ?? config.agentType);
+    console.log(`machine:         ${identity.name} (${identity.machine_id})`);
+    console.log(`agent:           ${agentType}`);
 }
 function helpText() {
     return `navarch-runtime — Navarch machine-side session manager
 
 Usage:
   navarch-runtime register --token <enrollment-token> --name <machine-name> \\
-      [--capabilities a,b] [--max-sessions N] [--owner-zone z] [--api-base url]
+      [--agent claude-code|codex] [--capabilities a,b] [--max-sessions N] [--owner-zone z] [--api-base url]
   navarch-runtime connect --token <enrollment-token> --name <machine-name> \\
-      [--project <project-id>] [--capabilities a,b] [--max-sessions N] [--api-base url]
-  navarch-runtime start
+      [--agent claude-code|codex] [--project <project-id>] [--capabilities a,b] [--max-sessions N] [--api-base url]
+  navarch-runtime start [--agent claude-code|codex]
   navarch-runtime doctor
 
 Configuration is via NAVARCH_* environment variables; see runtime/README.md.
@@ -198,10 +222,10 @@ async function main(argv = process.argv.slice(2)) {
                 await connectCommand(flags);
                 break;
             case "start":
-                await startCommand();
+                await startCommand(flags);
                 break;
             case "doctor":
-                await doctorCommand();
+                await doctorCommand(flags);
                 break;
             case "help":
             case "--help":

package/dist/config.cjs

@@ -3,9 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRuntimeAgentType = isRuntimeAgentType;
 exports.loadRuntimeConfig = loadRuntimeConfig;
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
+function isRuntimeAgentType(value) {
+    return value === "claude-code" || value === "codex";
+}
 function envInt(env, name, fallback) {
     const raw = env[name];
     if (!raw)
@@ -30,12 +34,17 @@ function envList(env, name, fallback) {
 function loadRuntimeConfig(env = process.env) {
     const configDir = env.NAVARCH_CONFIG_DIR ?? node_path_1.default.join(node_os_1.default.homedir(), ".navarch");
     const leaseHeartbeatIntervalMs = envInt(env, "NAVARCH_LEASE_HEARTBEAT_INTERVAL_MS", 5 * 60 * 1000);
+    // Run the agent with the resources already available on its machine by
+    // default. Docker isolation is an explicit operator opt-in, not a
+    // prerequisite for claiming ordinary shell work.
+    const sandboxMode = env.NAVARCH_SANDBOX_MODE === "docker" ? "docker" : "host";
+    const defaultCapabilities = sandboxMode === "docker" ? ["docker-sandbox", "shell"] : ["shell"];
     return {
         apiBase: env.NAVARCH_API_BASE ?? "http://localhost:3000",
         workspaceRoot: env.NAVARCH_WORKSPACE_ROOT ?? node_path_1.default.join(configDir, "sandboxes"),
         configDir,
-        maxSessions: envInt(env, "NAVARCH_MAX_SESSIONS", 3),
-        capabilities: envList(env, "NAVARCH_CAPABILITIES", ["docker-sandbox", "shell"]),
+        maxSessions: envInt(env, "NAVARCH_MAX_SESSIONS", 5),
+        capabilities: envList(env, "NAVARCH_CAPABILITIES", defaultCapabilities),
         ownerZone: env.NAVARCH_OWNER_ZONE ?? "sagentlab",
         pollIntervalMs: envInt(env, "NAVARCH_POLL_INTERVAL_MS", 5000),
         machineHeartbeatIntervalMs: envInt(env, "NAVARCH_HEARTBEAT_INTERVAL_MS", 60_000),
@@ -43,13 +52,13 @@ function loadRuntimeConfig(env = process.env) {
         // interval must stay comfortably under that TTL.
         leaseHeartbeatIntervalMs,
         sessionTimeoutMs: envInt(env, "NAVARCH_SESSION_TIMEOUT_MS", 45 * 60 * 1000),
-        agentType: env.NAVARCH_AGENT === "codex" ? "codex" : "claude-code",
+        agentType: isRuntimeAgentType(env.NAVARCH_AGENT) ? env.NAVARCH_AGENT : "claude-code",
         claudeBin: env.NAVARCH_CLAUDE_BIN ?? "claude",
         claudeExtraArgs: envList(env, "NAVARCH_CLAUDE_EXTRA_ARGS", []),
         codexBin: env.NAVARCH_CODEX_BIN ?? "codex",
         codexExtraArgs: envList(env, "NAVARCH_CODEX_EXTRA_ARGS", []),
         mcpConfigPath: env.NAVARCH_MCP_CONFIG_PATH ?? null,
-        sandboxMode: env.NAVARCH_SANDBOX_MODE === "host" ? "host" : "docker",
+        sandboxMode,
         dockerImage: env.NAVARCH_DOCKER_IMAGE ?? "node:20-slim",
     };
 }

package/dist/exit-conditions.cjs

@@ -1,17 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractPrUrl = extractPrUrl;
 exports.parseClaudeJsonResult = parseClaudeJsonResult;
 exports.extractUsageFromClaudeJson = extractUsageFromClaudeJson;
 exports.parseCodexJsonEvents = parseCodexJsonEvents;
 exports.extractUsageFromCodexEvents = extractUsageFromCodexEvents;
 exports.extractFinalMessageFromCodexEvents = extractFinalMessageFromCodexEvents;
 exports.mapExitCondition = mapExitCondition;
-const PR_URL_PATTERN = /https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+/;
-function extractPrUrl(text) {
-    const match = text.match(PR_URL_PATTERN);
-    return match ? match[0] : null;
-}
 /**
  * Best-effort parse of `claude -p --output-format json` stdout into the
  * assumed result shape above. Tries the whole trimmed stdout first (the
@@ -69,10 +63,9 @@ function extractUsageFromClaudeJson(parsed) {
 }
 /**
  * Best-effort line-by-line parse of `codex exec --json` stdout into the
- * assumed JSONL event shape above. Silently skips any line that isn't a JSON
- * object carrying a `msg` field (blank lines, stray log lines, a shape that
- * doesn't match the guess) rather than throwing; returns an empty array (not
- * null) when nothing parses, since a run can legitimately emit zero events.
+ * verified JSONL event shape above. Silently skips any line that isn't a
+ * recognized JSON event (blank lines, stray log lines, unrelated objects)
+ * rather than throwing; returns an empty array when nothing parses.
  */
 function parseCodexJsonEvents(stdout) {
     const events = [];
@@ -83,8 +76,10 @@ function parseCodexJsonEvents(stdout) {
     for (const line of lines) {
         try {
             const parsed = JSON.parse(line);
-            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && "msg" in parsed) {
-                events.push(parsed);
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+                const event = parsed;
+                if (typeof event.type === "string" || event.msg !== undefined)
+                    events.push(event);
             }
         }
         catch {
@@ -94,17 +89,20 @@ function parseCodexJsonEvents(stdout) {
     return events;
 }
 /**
- * Extracts token/cost usage from parsed `codex exec --json` events. Assumes
- * each `token_count` event reports the run's cumulative totals so far (like
- * Claude Code's running usage updates), so the *last* such event wins rather
- * than summing across events; if that assumption is wrong (incremental
- * per-turn deltas instead), this under- or over-counts until reconciled here.
+ * Extracts token/cost usage from parsed `codex exec --json` events. The last
+ * `turn.completed` event wins. Legacy `token_count` events remain supported.
  */
 function extractUsageFromCodexEvents(events) {
     let tokensIn = 0;
     let tokensOut = 0;
     let costUsd = 0;
     for (const event of events) {
+        if (event.type === "turn.completed" && event.usage) {
+            tokensIn = event.usage.input_tokens ?? 0;
+            tokensOut = event.usage.output_tokens ?? 0;
+            if (typeof event.usage.total_cost_usd === "number")
+                costUsd = event.usage.total_cost_usd;
+        }
         if (event.msg?.type === "token_count") {
             tokensIn = (event.msg.input_tokens ?? 0) + (event.msg.cached_input_tokens ?? 0);
             tokensOut = event.msg.output_tokens ?? 0;
@@ -115,9 +113,15 @@ function extractUsageFromCodexEvents(events) {
     }
     return { tokensIn, tokensOut, costUsd };
 }
-/** The last `agent_message` event's text — assumed to be the run's final agent-visible output, mirroring Claude JSON result's `result` field. Returns null when no such event parsed (see parseCodexJsonEvents doc comment). */
+/** The last completed agent message, with legacy `msg.agent_message` fallback. */
 function extractFinalMessageFromCodexEvents(events) {
     for (let i = events.length - 1; i >= 0; i--) {
+        const item = events[i]?.item;
+        if (events[i]?.type === "item.completed" &&
+            item?.type === "agent_message" &&
+            typeof item.text === "string") {
+            return item.text;
+        }
         const msg = events[i]?.msg;
         if (msg?.type === "agent_message" && typeof msg.message === "string")
             return msg.message;
@@ -139,8 +143,11 @@ function summarize(text, maxLen = 500) {
  * exit > clean exit.
  */
 function mapExitCondition(result) {
-    const prUrl = extractPrUrl(result.stdout) ?? extractPrUrl(result.stderr);
-    const evidenceUrls = prUrl ? [prUrl] : [];
+    // Agent output is untrusted evidence, including the final completion
+    // message. session.cts resolves PR evidence independently through GitHub
+    // using this session's exact repository and worktree head branch.
+    const parsedJson = parseClaudeJsonResult(result.stdout);
+    const evidenceUrls = [];
     if (result.killedByLeaseLoss) {
         return {
             leaseOutcome: "failed",
@@ -179,9 +186,20 @@ function mapExitCondition(result) {
     // json` blob so report_summary doesn't end up being a dumped JSON object;
     // falls back to raw stdout when neither is available (see
     // parseClaudeJsonResult's doc comment).
-    const parsedJson = parseClaudeJsonResult(result.stdout);
     const reportText = result.reportText ?? parsedJson?.result ?? result.stdout;
     const reportSummary = summarize(reportText) || "Adapter completed with no report text.";
+    // Headless agent CLIs normally exit 0 after producing a final response,
+    // including when that response says the task could not start. Treat an
+    // explicit leading blocked verdict as a failed lease so the dispatcher can
+    // retry/escalate it instead of falsely moving unfinished work to Done.
+    if (/^blocked(?:\s|:|$)/i.test(reportText.trim())) {
+        return {
+            leaseOutcome: "failed",
+            exitStatus: "failed",
+            reportSummary,
+            evidenceUrls,
+        };
+    }
     return {
         leaseOutcome: "completed",
         exitStatus: "completed",

package/dist/git-worktree.cjs

@@ -0,0 +1,145 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitWorktree = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = require("node:fs");
+const sandbox_cjs_1 = require("./sandbox.cjs");
+const repositoryLocks = new Map();
+/**
+ * Maintains one bare repository cache per project and checks out each session
+ * into its own uniquely named worktree. The cache avoids N full clones while
+ * git's worktree metadata keeps concurrent agents from sharing an index or
+ * working directory.
+ */
+class GitWorktree {
+    sessionRoot;
+    worktreePath;
+    repositoryPath;
+    branch;
+    runner;
+    cloneUrl;
+    githubToken;
+    constructor(options) {
+        const projectKey = safePathSegment(options.projectId);
+        const sessionKey = safePathSegment(options.sessionId);
+        this.sessionRoot = node_path_1.default.join(options.workspaceRoot, "sessions", sessionKey);
+        this.worktreePath = node_path_1.default.join(this.sessionRoot, "repo");
+        this.repositoryPath = node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
+        this.branch = `navarch/${safePathSegment(options.taskId).slice(0, 32)}-${sessionKey.slice(0, 12)}`;
+        this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
+        this.cloneUrl = options.cloneUrl;
+        this.githubToken = options.githubToken;
+    }
+    async prepare() {
+        await node_fs_1.promises.mkdir(node_path_1.default.dirname(this.repositoryPath), { recursive: true });
+        await node_fs_1.promises.mkdir(this.sessionRoot, { recursive: true });
+        await withRepositoryLock(this.repositoryPath, async () => {
+            if (!(await pathExists(node_path_1.default.join(this.repositoryPath, "HEAD")))) {
+                await this.runGit(["clone", "--bare", this.cloneUrl, this.repositoryPath], true);
+            }
+            else {
+                const origin = await this.runGit(["--git-dir", this.repositoryPath, "remote", "get-url", "origin"], false);
+                if (normalizeCloneUrl(origin.stdout) !== normalizeCloneUrl(this.cloneUrl)) {
+                    await this.runGit(["--git-dir", this.repositoryPath, "remote", "set-url", "origin", this.cloneUrl], false);
+                }
+            }
+            const remoteHead = await this.runGit(["--git-dir", this.repositoryPath, "ls-remote", "--symref", "origin", "HEAD"], true);
+            const defaultBranch = parseRemoteHead(remoteHead.stdout);
+            const startRef = defaultBranch
+                ? defaultBranch.replace(/^refs\/heads\//, "refs/remotes/origin/")
+                : "HEAD";
+            await this.runGit([
+                "--git-dir",
+                this.repositoryPath,
+                "fetch",
+                "--prune",
+                "origin",
+                "+refs/heads/*:refs/remotes/origin/*",
+            ], true);
+            await this.runGit([
+                "--git-dir",
+                this.repositoryPath,
+                "worktree",
+                "add",
+                "-b",
+                this.branch,
+                this.worktreePath,
+                startRef,
+            ], false);
+        });
+    }
+    async cleanup() {
+        await withRepositoryLock(this.repositoryPath, async () => {
+            await this.runner
+                .run("git", ["--git-dir", this.repositoryPath, "worktree", "remove", "--force", this.worktreePath])
+                .catch(() => undefined);
+            await this.runner
+                .run("git", ["--git-dir", this.repositoryPath, "branch", "-D", this.branch])
+                .catch(() => undefined);
+            await this.runner
+                .run("git", ["--git-dir", this.repositoryPath, "worktree", "prune"])
+                .catch(() => undefined);
+        });
+    }
+    async runGit(args, authenticated) {
+        const credentialArgs = authenticated && this.githubToken
+            ? [
+                "-c",
+                'credential.helper=!f() { echo username=x-access-token; echo "password=$GITHUB_TOKEN"; }; f',
+            ]
+            : [];
+        const result = await this.runner.run("git", [...credentialArgs, ...args], {
+            env: this.githubToken
+                ? { ...process.env, GITHUB_TOKEN: this.githubToken, GIT_TERMINAL_PROMPT: "0" }
+                : { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+        });
+        if (result.code !== 0) {
+            throw new Error(`git ${args[0] ?? "command"} failed: ${result.stderr || result.stdout}`);
+        }
+        return result;
+    }
+}
+exports.GitWorktree = GitWorktree;
+async function withRepositoryLock(key, work) {
+    const previous = repositoryLocks.get(key) ?? Promise.resolve();
+    let release;
+    const current = new Promise((resolve) => {
+        release = resolve;
+    });
+    const queued = previous.then(() => current);
+    repositoryLocks.set(key, queued);
+    await previous;
+    try {
+        return await work();
+    }
+    finally {
+        release();
+        if (repositoryLocks.get(key) === queued)
+            repositoryLocks.delete(key);
+    }
+}
+async function pathExists(value) {
+    try {
+        await node_fs_1.promises.access(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function safePathSegment(value) {
+    const safe = value.replace(/[^A-Za-z0-9_.-]/g, "-").replace(/^-+|-+$/g, "");
+    if (!safe)
+        throw new Error("Cannot create a git worktree without a valid project/session identifier.");
+    return safe;
+}
+function normalizeCloneUrl(value) {
+    return value.trim().replace(/\.git$/, "").replace(/\/+$/, "").toLowerCase();
+}
+function parseRemoteHead(output) {
+    const match = output.match(/^ref:\s+(refs\/heads\/[A-Za-z0-9._/-]+)\s+HEAD$/m);
+    return match?.[1] ?? null;
+}

package/dist/github-pr.cjs

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findHeadBranchPullRequestUrl = findHeadBranchPullRequestUrl;
+const sandbox_cjs_1 = require("./sandbox.cjs");
+async function readHostGhToken() {
+    // Keep the credential in memory and out of shell parsing, argv, and logs.
+    const result = await sandbox_cjs_1.nodeCommandRunner.run("gh", ["auth", "token", "--hostname", "github.com"], { timeoutMs: 5_000 });
+    if (result.code !== 0)
+        return undefined;
+    const token = result.stdout.trim();
+    return token && !/\s/.test(token) ? token : undefined;
+}
+async function resolveGitHubToken(options) {
+    if (options.githubToken)
+        return options.githubToken;
+    try {
+        // Resolution is intentionally best-effort so public-repository lookup can
+        // still proceed when gh is absent or has no authenticated host account.
+        return await (options.hostTokenProvider ?? readHostGhToken)();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Finds the PR opened from this session's exact same-repository head branch.
+ * GitHub's head filter narrows the response, and the response is checked again
+ * before its URL is trusted so another repository or branch can never be
+ * attached as completion evidence.
+ */
+async function findHeadBranchPullRequestUrl(options) {
+    const [owner, name, ...extra] = options.repository.split("/");
+    if (!owner || !name || extra.length > 0) {
+        throw new Error(`Invalid GitHub repository name: ${options.repository}`);
+    }
+    const url = new URL(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls`);
+    url.searchParams.set("state", "all");
+    url.searchParams.set("head", `${owner}:${options.headBranch}`);
+    url.searchParams.set("per_page", "10");
+    const headers = {
+        accept: "application/vnd.github+json",
+        "user-agent": "navarch-runtime",
+        "x-github-api-version": "2022-11-28",
+    };
+    const githubToken = await resolveGitHubToken(options);
+    if (githubToken)
+        headers.authorization = `Bearer ${githubToken}`;
+    const response = await (options.fetchImpl ?? fetch)(url, { headers });
+    if (!response.ok) {
+        throw new Error(`GitHub pull request lookup failed with HTTP ${response.status}`);
+    }
+    const body = await response.json();
+    if (!Array.isArray(body)) {
+        throw new Error("GitHub pull request lookup returned a non-array response");
+    }
+    const normalizedRepository = options.repository.toLowerCase();
+    for (const candidate of body) {
+        if (candidate.head?.ref !== options.headBranch)
+            continue;
+        const headRepository = candidate.head.repo?.full_name;
+        if (typeof headRepository !== "string")
+            continue;
+        if (headRepository.toLowerCase() !== normalizedRepository)
+            continue;
+        if (typeof candidate.html_url !== "string")
+            continue;
+        if (!isPullRequestUrlForRepository(candidate.html_url, normalizedRepository))
+            continue;
+        return candidate.html_url;
+    }
+    return null;
+}
+function isPullRequestUrlForRepository(value, repository) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" || url.hostname.toLowerCase() !== "github.com")
+            return false;
+        const parts = url.pathname.split("/").filter(Boolean);
+        return (parts.length === 4 &&
+            `${parts[0]}/${parts[1]}`.toLowerCase() === repository &&
+            parts[2] === "pull" &&
+            /^\d+$/.test(parts[3] ?? ""));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/machine-store.cjs

@@ -48,6 +48,9 @@ async function resolveMachineIdentity(configDir, apiBaseFallback) {
             token: envToken,
             name: process.env.NAVARCH_MACHINE_NAME ?? envId,
             api_base: process.env.NAVARCH_API_BASE ?? apiBaseFallback,
+            agent_type: process.env.NAVARCH_AGENT === "codex" || process.env.NAVARCH_AGENT === "claude-code"
+                ? process.env.NAVARCH_AGENT
+                : undefined,
         };
     }
     const stored = await loadMachineIdentity(configDir);

package/dist/prompt.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderPrompt = renderPrompt;
+exports.renderGuidanceCorrectionPrompt = renderGuidanceCorrectionPrompt;
 /**
  * Renders the four-layer context bundle (project-plan.md §3.8: steering docs,
  * task itself, task-type playbook, depends_on reports) into the single prompt
@@ -10,13 +11,19 @@ exports.renderPrompt = renderPrompt;
  */
 function renderPrompt(task, bundle) {
     if (bundle.task_context) {
-        return [bundle.task_context.trim(), bundle.retry_context?.trim()]
+        const repositoryContext = bundle.repository
+            ? `Repository: ${bundle.repository.full_name} (${bundle.repository.url})\nLocal checkout: this session's isolated git worktree (current working directory).`
+            : null;
+        return [repositoryContext, bundle.task_context.trim(), bundle.retry_context?.trim()]
             .filter((section) => Boolean(section))
             .join("\n\n") + "\n";
     }
     const sections = [];
     sections.push(`# Task: ${task.summary}`);
     sections.push(`Type: ${task.task_type} | Repo: ${task.repo} | Environment: ${task.environment_scope}`);
+    if (bundle.repository) {
+        sections.push(`Repository URL: ${bundle.repository.url}\nLocal checkout: this session's isolated git worktree (current working directory).`);
+    }
     if (task.github_issue_url) {
         sections.push(`GitHub issue: ${task.github_issue_url}`);
     }
@@ -36,3 +43,20 @@ function renderPrompt(task, bundle) {
     sections.push(bundle.playbook);
     return sections.join("\n\n");
 }
+/**
+ * Builds a fresh agent turn after a human steers an active task. The runtime
+ * keeps the same worktree, so the replacement turn can inspect and continue
+ * partial edits instead of discarding mid-flight work.
+ */
+function renderGuidanceCorrectionPrompt(originalPrompt, guidance) {
+    const corrections = guidance.map((entry) => `- **${entry.given_at}**: ${entry.content}`);
+    return [
+        originalPrompt.trim(),
+        "## Mid-flight human guidance",
+        "",
+        "The task was actively steered while you were working. Human guidance takes precedence over earlier context. Continue in the same worktree: inspect the current changes, correct course, and then finish the task.",
+        "",
+        ...corrections,
+        "",
+    ].join("\n");
+}

package/dist/sandbox.cjs

@@ -15,7 +15,7 @@ exports.SandboxUnavailableError = SandboxUnavailableError;
 exports.nodeCommandRunner = {
     run(cmd, args, opts = {}) {
         return new Promise((resolve, reject) => {
-            const child = (0, node_child_process_1.spawn)(cmd, args, { cwd: opts.cwd });
+            const child = (0, node_child_process_1.spawn)(cmd, args, { cwd: opts.cwd, env: opts.env });
             let stdout = "";
             let stderr = "";
             let settled = false;
@@ -91,14 +91,27 @@ class DockerSandbox {
     runner;
     workDir;
     image;
+    containerWorkDir;
+    sharedGitDir;
     constructor(opts) {
         this.name = containerName(opts.sessionId);
         this.runner = opts.runner ?? exports.nodeCommandRunner;
         this.workDir = node_path_1.default.join(opts.workspaceRoot, opts.sessionId);
         this.image = opts.image;
+        this.containerWorkDir = opts.containerWorkDir ?? null;
+        this.sharedGitDir = opts.sharedGitDir ?? null;
     }
     async create() {
         await node_fs_1.promises.mkdir(this.workDir, { recursive: true });
+        const mounts = this.containerWorkDir
+            ? [
+                "-v",
+                `${this.workDir}:${this.workDir}`,
+                ...(this.sharedGitDir ? ["-v", `${this.sharedGitDir}:${this.sharedGitDir}`] : []),
+                "-w",
+                this.containerWorkDir,
+            ]
+            : ["-v", `${this.workDir}:/workspace`, "-w", "/workspace"];
         const result = await this.runner.run("docker", [
             "run",
             "-d",
@@ -110,10 +123,7 @@ class DockerSandbox {
             "/tmp",
             "--tmpfs",
             "/run",
-            "-v",
-            `${this.workDir}:/workspace`,
-            "-w",
-            "/workspace",
+            ...mounts,
             this.image,
             "tail",
             "-f",
@@ -156,9 +166,13 @@ class DockerSandbox {
     }
     /** Force-removes the container and the host-side workspace mount. Best-effort: never throws. */
     async wipe() {
-        await this.runner.run("docker", ["rm", "-f", this.name]).catch(() => undefined);
+        await this.stop();
         await node_fs_1.promises.rm(this.workDir, { recursive: true, force: true }).catch(() => undefined);
     }
+    /** Stops/removes only the container; the session orchestrator owns worktree cleanup. */
+    async stop() {
+        await this.runner.run("docker", ["rm", "-f", this.name]).catch(() => undefined);
+    }
 }
 exports.DockerSandbox = DockerSandbox;
 function shellQuote(value) {