@sagentlab/navarch-runtime 0.1.106 → 0.1.107

package/README.md

@@ -717,8 +717,12 @@ post-tool answer as the report, and reads aggregate `input_tokens` and
 cost, so an unknown value remains absent rather than becoming zero.
 
 Gemini's native sandbox launcher converts piped stdin back into a `--prompt`
-argument for its child. The adapter rejects prompts of 128 KiB or more when
-that sandbox is enabled, with an explicit diagnostic; reducing context or
+argument for its child. When that sandbox follows Linux argv rules (a Linux
+host, a Docker session, or a `docker`/`podman` sandbox chosen through
+`GEMINI_SANDBOX`), the adapter rejects prompts of 128 KiB or more; macOS
+`sandbox-exec` has no per-string limit, so there the adapter only rejects
+prompts that would approach the 1 MiB total argv limit (about 900 KiB once
+shell-quoted). Both rejections carry an explicit diagnostic; reducing context or
 selecting another runtime preserves the worktree boundary. Navarch Docker
 mode disables the nested Gemini sandbox by default and can still pipe larger
 prompts. All Gemini runs reject prompts above 8 MiB because Gemini's stdin

package/dist/adapters/gemini.cjs

@@ -17,8 +17,10 @@ const kill_agent_cjs_1 = require("../kill-agent.cjs");
  *
  * The prompt arrives on stdin rather than `--prompt`: Gemini runs headlessly
  * whenever stdin is not a TTY and uses the piped text as the prompt. Its
- * native sandbox puts stdin back into argv, so that path still has Linux's
- * 128 KiB per-string limit. Gemini also caps stdin at 8 MiB.
+ * native sandbox puts stdin back into argv, so that path still has an argv
+ * limit: Linux's 128 KiB per-string limit for container sandboxes and Linux
+ * hosts, or macOS's 1 MiB total for sandbox-exec. Gemini also caps stdin at
+ * 8 MiB.
  */
 async function runGeminiAdapter(options) {
     if (options.signal?.aborted) {
@@ -70,9 +72,21 @@ async function runGeminiAdapter(options) {
     // Gemini's sandbox launcher reads stdin and injects it back into --prompt
     // for its child process (packages/cli/src/gemini.tsx injectStdinIntoArgs).
     // Moving our first spawn's prompt to stdin cannot fix that second spawn.
-    // Check the effective flag, including operator overrides, without disabling
-    // the worktree guard. Even on macOS a Docker sandbox may launch on Linux.
-    if (geminiSandboxEnabled(args) && promptBytes >= 128 * 1024) {
+    // Check the effective sandbox, including operator overrides, without
+    // disabling the worktree guard. Even on macOS a Docker sandbox may launch on
+    // Linux, while macOS sandbox-exec re-quotes the prompt into one `sh -c`
+    // string that only the 1 MiB total ARG_MAX bounds.
+    const platform = options.dockerExec ? "linux" : process.platform;
+    const sandboxCommand = geminiSandboxCommand(args, geminiProcessEnv(options, env), platform);
+    if (sandboxCommand === "sandbox-exec" && platform === "darwin") {
+        // shell-quote backslash-escapes these inside the double-quoted prompt.
+        // Leave the rest of ARG_MAX for the environment and Gemini's own args.
+        const quotedBytes = promptBytes + (options.prompt.match(/["\\$`!]/g)?.length ?? 0);
+        if (quotedBytes > 900 * 1024) {
+            return inputFailure(`Gemini CLI re-encodes stdin as --prompt when launching its macOS sandbox-exec sandbox; the ${promptBytes}-byte task prompt exceeds macOS's 1 MiB argv limit. Reduce the context bundle or select another runtime that supports large prompts in its sandbox.`);
+        }
+    }
+    else if (sandboxCommand && promptBytes >= 128 * 1024) {
         return inputFailure(`Gemini CLI re-encodes stdin as --prompt when launching its native sandbox; the ${promptBytes}-byte task prompt exceeds Linux's argv limit. Reduce the context bundle or select another runtime that supports large prompts in its sandbox.`);
     }
     const runOptions = { ...options, env };
@@ -84,7 +98,30 @@ async function runGeminiAdapter(options) {
 function inputFailure(stderr) {
     return { exitCode: 1, timedOut: false, killedByLeaseLoss: false, stdout: "", stderr };
 }
-function geminiSandboxEnabled(args) {
+function geminiProcessEnv(options, env) {
+    // Docker exec forwards only the session env names into the container.
+    return options.dockerExec ? env : { ...process.env, ...env };
+}
+/**
+ * Mirrors Gemini's getSandboxCommand (packages/cli/src/config/sandboxConfig.ts):
+ * GEMINI_SANDBOX overrides the --sandbox flag and may name the command;
+ * otherwise an enabled sandbox is sandbox-exec on macOS and a container
+ * (docker or podman) elsewhere. Returns null when no sandbox relaunch occurs.
+ */
+function geminiSandboxCommand(args, env, platform) {
+    const configured = env.GEMINI_SANDBOX?.toLowerCase().trim() ?? "";
+    let sandbox = configured.length > 0 ? configured : geminiSandboxFlag(args);
+    if (sandbox === "1" || sandbox === "true")
+        sandbox = true;
+    else if (sandbox === "0" || sandbox === "false" || !sandbox)
+        sandbox = false;
+    if (sandbox === false)
+        return null;
+    if (typeof sandbox === "string")
+        return sandbox;
+    return platform === "darwin" ? "sandbox-exec" : "docker";
+}
+function geminiSandboxFlag(args) {
     // There is always a generated --sandbox flag unless extraArgs supplies one.
     // Like yargs, later explicit values override earlier ones.
     let enabled = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.106",
+  "version": "0.1.107",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",