@sagentlab/navarch-runtime 0.1.116 → 0.1.118

package/README.md

@@ -95,7 +95,8 @@ when the run finishes, so the task view can follow a connected run live.
 Live snapshots hold the current turn's stderr back until the turn ends.
 
 The machine operator selects **Claude Code**, **OpenAI Codex**, **Google
-Antigravity CLI**, **OpenCode**, or an **Agent Client Protocol (ACP)** agent when connecting a worker. Any selected agent can
+Antigravity CLI**, **OpenCode**, an **Agent Client Protocol (ACP)** agent, **Qoder**,
+**Pi (local)**, or **Muse Code (experimental)** when connecting a worker. Any selected agent can
 run any unpinned project task; task eligibility depends on capabilities and
 project gates. A task pinned to a runtime waits for a worker that advertises
 that adapter and runs on it — see "Choosing an agent" below.
@@ -118,7 +119,8 @@ Before generating the command, prepare the machine:
 - install Node.js 20 or later (the standard installation includes `npm` and
   `npx`) and Git;
 - install the coding-agent CLI selected in Navarch — `claude`, `codex`,
-  `agy`, `opencode`, `dsh` for the default ACP integration, or `qoder` — and complete its normal authentication flow; and
+  `agy`, `opencode`, `dsh` for the default ACP integration, `qoder`, `pi`,
+  or `muse` — and complete its normal authentication flow; and
 - for Docker-backed sessions, install and start Docker and use an image that
   contains the selected agent CLI and the repository toolchain, with provider
   credentials supplied through the approved machine or project configuration.
@@ -241,11 +243,11 @@ The from-source flow — `git clone` + `./install.sh` + `node bin/navarch.cjs
 
 | Command | Purpose |
 |---|---|
-| `register --token <t> --name <n> [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder] […]` | Registers this machine, saves its local agent choice, and prints the token once. |
-| `connect --token <t> --name <n> [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder] [--project <id>] […]` | Connects this machine to one project, saves its local agent choice, and prints the token once. |
-| `start [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder]` | Runs the daemon. A start-time agent choice overrides the saved choice. |
-| `supervise [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder]` | Runs the daemon under the update supervisor, enabling drain-safe automatic updates and rollback. |
-| `doctor [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder]` | Prints resolved config + Docker/registration status; no side effects. |
+| `register --token <t> --name <n> [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder\|muse\|pi-local] […]` | Registers this machine, saves its local agent choice, and prints the token once. |
+| `connect --token <t> --name <n> [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder\|muse\|pi-local] [--project <id>] […]` | Connects this machine to one project, saves its local agent choice, and prints the token once. |
+| `start [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder\|muse\|pi-local]` | Runs the daemon. A start-time agent choice overrides the saved choice. |
+| `supervise [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder\|muse\|pi-local]` | Runs the daemon under the update supervisor, enabling drain-safe automatic updates and rollback. |
+| `doctor [--agent claude-code\|codex\|antigravity\|opencode\|acp\|qoder\|muse\|pi-local]` | Prints resolved config + Docker/registration status; no side effects. |
 
 ### Running multiple agents on one machine
 
@@ -459,7 +461,7 @@ unchanged across the deployment.
 | `NAVARCH_SANDBOX_PROFILE` | `trusted-development` | Named security profile for Docker sessions (`src/sandbox-profile.cts`): `trusted-development` (image-default user, uncapped, open egress), `untrusted-code` (non-root, 2 CPU / 4g / 512 PIDs, deny-by-default egress, read-only shared git), `elevated-verification` (non-root, 4 CPU / 8g / 2048 PIDs, egress limited to GitHub plus package registries). The default is the exact pre-profile flag set. |
 | `NAVARCH_SANDBOX_EGRESS_NETWORK` | _(unset)_ | Docker network that enforces a profile's egress allowlist. Docker cannot filter by domain itself, so an allowlist profile without this fails closed to `--network=none` and records the denial. |
 | `NAVARCH_DOCKER_IMAGE` | `ghcr.io/sagentlab/navarch-sandbox-agent:0.1.0` | Version-pinned per-session image with Node 20, git, GitHub CLI, ripgrep, jq, SSH, and Claude Code 2.1.218. Override with an image tag or digest you control. |
-| `NAVARCH_AGENT` | saved choice, then `claude-code` | Local choice of agent adapter: `claude-code`, `codex`, `agy`, `opencode`, `acp`, or `qoder`. Overrides the choice saved by `connect`/`register`; `start --agent` has highest priority. |
+| `NAVARCH_AGENT` | saved choice, then `claude-code` | Local choice of agent adapter: `claude-code`, `codex`, `antigravity`, `opencode`, `acp`, `qoder`, `muse`, or `pi-local`. Overrides the choice saved by `connect`/`register`; `start --agent` has highest priority. |
 | `NAVARCH_RUNTIMES` | resolved local agent choice | Comma list of installed/authenticated adapters advertised to dispatch. Unpinned tasks run on the preferred agent; a task runtime pin selects the matching adapter. Unrecognized ids are dropped with a warning that names them, so a typo cannot silently shrink the advertised set. |
 | `NAVARCH_UPDATE_CHANNEL` | `stable` | Release channel advertised by the worker (`stable` or `canary`); the server-managed machine channel remains authoritative. |
 | `NAVARCH_AUTO_UPDATE` | on under `supervise` | Set `off`, `false`, or `0` to report releases without staging or activating them. Automatic activation is always off under plain `start`. |
@@ -475,8 +477,10 @@ unchanged across the deployment.
 | `NAVARCH_ACP_EXTRA_ARGS` | `--profile,acp` | Comma list of arguments used to start the ACP server. Override this together with `NAVARCH_ACP_BIN` for another ACP-compatible coding agent. |
 | `NAVARCH_QODER_BIN` | `qoder` | Path/name of the Qoder CLI binary. |
 | `NAVARCH_QODER_EXTRA_ARGS` | — | Comma list of extra CLI args appended after the unattended defaults (`--setting-sources`, `--permission-mode auto`, `--output-format json`). An explicit `--output-format`, `--permission-mode`, `--settings`, `--model`, or `--reasoning-effort` here replaces the per-session default. Qoder selects its own account models; pin one via `--model` here or `connect --model` to override. |
+| `NAVARCH_MUSE_BIN` | `muse` | Path/name of the native Muse Code CLI. Requires authenticated experimental `muse serve` SDK access; the npm SDK does not install the CLI. See [Muse Code setup](../docs/navarch/muse-code.md). |
+| `NAVARCH_MUSE_EXTRA_ARGS` | — | Comma list of arguments passed to `muse serve`. Permission/sandbox bypass flags are rejected. Configure narrow native approval rules rather than enabling blanket approval. |
 | `NAVARCH_MCP_CONFIG_PATH` | — | Path to the platform MCP config passed as `--mcp-config`. |
-| `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable it for every runtime on the machine — required to run OpenCode on the host. |
+| `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable it for every runtime on the machine — required to run OpenCode or Muse on an already-isolated host. |
 | `NAVARCH_NAVI_CONVERSATIONS` | on | Serve read-only Navi repository conversations on this machine. Only the `claude-code` adapter on the host sandbox with the worktree guard on is supported; `navarch-runtime doctor` prints the `navi_chat:` state and reason. Set `off` to stop polling for conversations. |
 | `NAVARCH_NAVI_WORKSPACE_CHAT` | off | Explicitly enable writable Navi chat on a supported Claude Code host runtime. Owners can choose **Edit and run commands**; automatic permission review and the worktree guard remain active. Commands run on this host, not in a hard sandbox. Changes stay under `<workspaceRoot>/chat-workspaces/<conversationId>/repo` until the operator removes them. See [workspace chat](../docs/navarch/navi-workspace-chat.md). |
 | `NAVARCH_CONVERSATION_POLL_MS` | `5000` | Idle poll interval for queued conversation turns (1000–30000). |
@@ -545,6 +549,18 @@ metadata directory.
   OpenCode receives a private, per-session config, project config discovery is
   disabled, and lease MCP headers are referenced through child-only environment
   variables instead of being copied into its config file or argv.
+- **Muse Code (experimental):** guarded hosts do not advertise Muse; a
+  Muse-only guarded worker fails closed before claiming. Use a custom Docker
+  image with native Muse, its authentication, Node.js, and the matching Navarch
+  runtime's `navarch-muse-mcp-bridge` executable. Use a dedicated clean Muse
+  configuration with no unrelated MCP servers, plugins, or hooks: session MCP
+  is additive to native configuration. The default image contains
+  neither Muse nor its bridge. A host guard opt-out is an explicit operator
+  choice for an already-isolated worker and removes the boundary machine-wide;
+  generated Muse setup commands never make that choice. Muse uses
+  `denyUnmatched`, verified by a session readback, and rejects interactive
+  approval requests. Preconfigure narrow rules for required shell/write actions
+  and the actual Navarch MCP tool namespace. See [Muse Code setup](../docs/navarch/muse-code.md).
 - **ACP agents:** the protocol client rejects every unattended permission
   escalation. The agent remains responsible for enforcing its declared file
   sandbox; use Navarch Docker mode when the ACP server itself does not provide
@@ -643,10 +659,15 @@ export NAVARCH_AGENT=acp
 # `connect --model` can pin one explicitly.
 export NAVARCH_AGENT=qoder
 
-# Advanced compatibility mode: advertise every installed adapter. On a guarded
-# host, `opencode` and `antigravity` are dropped from this list (see the boundary notes above);
-# the rest are advertised as written.
-export NAVARCH_RUNTIMES=claude-code,codex,antigravity,opencode,acp,qoder
+# Muse Code (experimental, runtime 0.1.117+) — see the dedicated setup
+# guide before starting: native authenticated `muse serve`, narrow approval
+# rules, clean native configuration, and deliberate isolation are required.
+export NAVARCH_AGENT=muse
+
+# Advanced compatibility mode: advertise every installed, configured adapter.
+# On a guarded host, `opencode`, `antigravity` and `muse` are dropped (see the
+# boundary notes above); the rest are advertised as written.
+export NAVARCH_RUNTIMES=claude-code,codex,antigravity,opencode,acp,qoder,muse
 ```
 
 For the legacy single-runtime setting, priority is `start --agent` →
@@ -660,10 +681,10 @@ or `claude-code`-pinned tasks. List only adapters this worker can really run:
 in Docker mode that means CLIs installed in `NAVARCH_DOCKER_IMAGE`, otherwise
 pinned tasks for a missing adapter are claimed and then fail.
 
-All five BYO adapters implement the same `AgentAdapter` interface
-(`src/adapters/types.cts`) and run either directly on the host or via
-`docker exec` in the session's sandbox container, exactly like the Claude
-adapter always has — `session.cts` picks one (`src/adapters/index.cts`'s
+The BYO adapters implement the same `AgentAdapter` interface
+(`src/adapters/types.cts`). Supported isolation modes are adapter-specific;
+Muse uses `muse serve` over stdio on an explicitly isolated host or through
+`docker exec -i` in a prepared custom container — `session.cts` picks one (`src/adapters/index.cts`'s
 `selectAdapter`) at the start of each session and passes `agent_type`
 through to `complete()` unchanged by whatever happened during the run.
 
@@ -678,6 +699,10 @@ reference (the platform default is `opencode/x-preview-f-free`, Ox Alpha Free
 (Unlimited) on OpenCode Zen), or `default` to preserve the authenticated
 account's selection. ACP sessions use the agent's advertised default model and
 set the standard `reasoning_effort` configuration option when it is available.
+Muse uses the account-owned `default` model; Navarch adds no Muse project-model
+column or public model catalog. Its SDK integration is experimental and has no
+Navi conversation capability. Read [Muse Code setup and limitations](../docs/navarch/muse-code.md)
+before using private repositories, especially Muse Contributor data settings.
 Machine-wide extra arguments still configure other CLI behavior; dispatched
 model policy wins.
 
@@ -838,6 +863,7 @@ cli.cts
                     - openCodeAdapter   (adapters/opencode.cts) — `opencode run --format json < prompt`
                     - acpAdapter        (adapters/acp.cts) — ACP v1 JSON-RPC/stdio; defaults to `dsh --profile acp`
                     - qoderAdapter      (adapters/qoder.cts) — `qoder -p --output-format json < prompt`
+                    - museAdapter       (adapters/muse.cts) — experimental Muse Session Protocol via `muse serve`
                   heartbeating the lease every NAVARCH_LEASE_HEARTBEAT_INTERVAL_MS throughout either;
                   a failed heartbeat aborts the run (kills the process) and marks the outcome as lease-lost
                5. mapExitCondition (exit-conditions.cts) → redact.cts scrubs the transcript → upload.cts PUTs it

package/bin/muse-mcp-bridge.cjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+"use strict";
+require("../dist/muse-mcp-bridge.cjs").main();

package/bin/worktree-guard-hook.cjs

@@ -173,12 +173,80 @@ function expandHome(value) {
   return value;
 }
 
+/**
+ * Previous character on the same line, ignoring blanks; "" at a true line
+ * start. A line that ends in an unescaped backslash continues onto the next
+ * line in the shell, so that backslash is returned instead.
+ */
+function previousSignificantChar(command, index) {
+  for (let i = index - 1; i >= 0; i--) {
+    const ch = command[i];
+    if (ch === "\n") {
+      let j = i - 1;
+      while (j >= 0 && (command[j] === "\r" || command[j] === " " || command[j] === "\t")) j--;
+      let slashes = 0;
+      while (j >= 0 && command[j] === "\\") {
+        slashes++;
+        j--;
+      }
+      return slashes % 2 === 1 ? "\\" : "";
+    }
+    if (ch !== " " && ch !== "\t") return ch;
+  }
+  return "";
+}
+
+/**
+ * True when the token sits directly after a quote that opens a word
+ * (`"/** x *\/"`). A closing quote (`"" /*`, `"x"/*`) leaves the token as a
+ * bare shell argument, so it does not count.
+ */
+function isInsideOpeningQuote(command, start) {
+  const quote = command[start - 1];
+  // Backticks run a command, so never use them to exempt a path token.
+  if (quote !== '"' && quote !== "'") return false;
+  // Only the command's first quote can prove an opening quoted word without
+  // parsing shell comments, heredocs and nested substitutions. Earlier quote
+  // characters make this ambiguous: keep screening rather than risk treating
+  // a closing quote after a continuation as an opening one.
+  if (/["'`]/.test(command.slice(0, start - 1))) return false;
+  const beforeQuote = command[start - 2];
+  return beforeQuote === undefined || /[\s=(<>;|&]/.test(beforeQuote);
+}
+
+/**
+ * True when a "/"-leading token is comment or markup text rather than a path:
+ * a closing tag (`</p>`), a block-comment opener (`/**`, `/*`), or a line
+ * comment (`// note`). Each rule is deliberately narrow so real escapes stay
+ * screened: tag names that exist at the filesystem root (`</home>`) are still
+ * checked, `/*` and `//` only count at a comment position (line start, right
+ * after an opening quote, or after `;`) so `rm -rf /*`, `find // -name x`
+ * and `rm -rf "" /*` stay blocked, and a block comment needs a closing
+ * `*` + `/` later in the text.
+ */
+function isCommentOrMarkupToken(command, start, token) {
+  const end = start + token.length;
+  const next = command[end];
+
+  if (command[start - 1] === "<" && next === ">" && /^\/[A-Za-z][\w:.-]*$/.test(token)) {
+    return !fs.existsSync(token);
+  }
+
+  const atCommentPosition =
+    isInsideOpeningQuote(command, start) ||
+    ["", ";"].includes(previousSignificantChar(command, start));
+  if (!atCommentPosition || next === undefined || !/\s/.test(next)) return false;
+  if (token === "/*" || token === "/**") return command.indexOf("*/", end) !== -1;
+  return token === "//" && /\S/.test(command.slice(end));
+}
+
 /**
  * Pulls path-like references out of a shell command: absolute paths,
  * home-anchored paths (`~...`, `$HOME/...`), and relative `..` traversals.
  * Lexical by design — see the file header for why this is a guardrail, not
  * a parser. URLs survive untouched (the char before `//` in `https://` is
- * `:`, which is not a path delimiter here).
+ * `:`, which is not a path delimiter here). Comment and markup text that
+ * merely starts with "/" (`/** doc *\/`, `// note`, `</p>`) is not a path.
  */
 function extractBashPathCandidates(command) {
   const candidates = [];
@@ -193,7 +261,11 @@ function extractBashPathCandidates(command) {
   const absoluteRe = /(?:^|[\s'"`=(<>;|&])(\/[^\s'"`<>;|&)]*)/g;
   const homeRe = /(?:^|[\s'"`=(<>;|&])((?:~|\$\{?HOME\}?)[^\s'"`<>;|&)]*)/g;
   let match;
-  while ((match = absoluteRe.exec(command))) add(match[1]);
+  while ((match = absoluteRe.exec(command))) {
+    const start = match.index + match[0].length - match[1].length;
+    if (isCommentOrMarkupToken(command, start, match[1])) continue;
+    add(match[1]);
+  }
   while ((match = homeRe.exec(command))) add(match[1]);
 
   for (const token of command.split(/[\s'"`;|&<>()]+/)) {

package/dist/adapters/index.cjs

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runQoderAdapter = exports.qoderAdapter = exports.runAcpAdapter = exports.acpAdapter = exports.runPiAdapter = exports.piAdapter = exports.runLocalPiAdapter = exports.localPiAdapter = exports.runOpenCodeAdapter = exports.openCodeAdapter = exports.runGeminiAdapter = exports.geminiAdapter = exports.runAntigravityAdapter = exports.antigravityAdapter = exports.runCodexAdapter = exports.codexAdapter = exports.runClaudeCodeAdapter = exports.claudeCodeAdapter = void 0;
+exports.runMuseAdapter = exports.museAdapter = exports.runQoderAdapter = exports.qoderAdapter = exports.runAcpAdapter = exports.acpAdapter = exports.runPiAdapter = exports.piAdapter = exports.runLocalPiAdapter = exports.localPiAdapter = exports.runOpenCodeAdapter = exports.openCodeAdapter = exports.runGeminiAdapter = exports.geminiAdapter = exports.runAntigravityAdapter = exports.antigravityAdapter = exports.runCodexAdapter = exports.codexAdapter = exports.runClaudeCodeAdapter = exports.claudeCodeAdapter = void 0;
 exports.selectAdapter = selectAdapter;
 const claude_cjs_1 = require("./claude.cjs");
 Object.defineProperty(exports, "claudeCodeAdapter", { enumerable: true, get: function () { return claude_cjs_1.claudeCodeAdapter; } });
@@ -29,6 +29,9 @@ Object.defineProperty(exports, "runAcpAdapter", { enumerable: true, get: functio
 const qoder_cjs_1 = require("./qoder.cjs");
 Object.defineProperty(exports, "qoderAdapter", { enumerable: true, get: function () { return qoder_cjs_1.qoderAdapter; } });
 Object.defineProperty(exports, "runQoderAdapter", { enumerable: true, get: function () { return qoder_cjs_1.runQoderAdapter; } });
+const muse_cjs_1 = require("./muse.cjs");
+Object.defineProperty(exports, "museAdapter", { enumerable: true, get: function () { return muse_cjs_1.museAdapter; } });
+Object.defineProperty(exports, "runMuseAdapter", { enumerable: true, get: function () { return muse_cjs_1.runMuseAdapter; } });
 /**
  * Picks the AgentAdapter (adapters/types.cts) session.cts should run a
  * session with, keyed off config.cts's `agentType` (NAVARCH_AGENT). This is
@@ -50,6 +53,8 @@ function selectAdapter(agentType) {
             return acp_cjs_1.acpAdapter;
         case "qoder":
             return qoder_cjs_1.qoderAdapter;
+        case "muse":
+            return muse_cjs_1.museAdapter;
         case "claude-code":
             return claude_cjs_1.claudeCodeAdapter;
         case "pi-local":