@sagentlab/navarch-runtime 0.1.12 → 0.1.13

package/README.md

@@ -254,13 +254,13 @@ unchanged across the deployment.
 | `NAVARCH_SESSION_TIMEOUT_MS` | `2700000` (45 min) | Hard kill timeout for a single session. |
 | `NAVARCH_GIT_AUTHOR_NAME` / `NAVARCH_GIT_AUTHOR_EMAIL` | `sagentlab` / `z@sagentlab.com` | Git identity forced into session commits so host-level personal config is not inherited; override both for a project-authorized bot. |
 | `NAVARCH_SANDBOX_MODE` | `host` | `host` uses the resources already available to the agent process. Set `docker` explicitly for container isolation. |
-| `NAVARCH_DOCKER_IMAGE` | `node:20-slim` | Image used for the per-session container. The image must contain the selected agent CLI, Git, Node.js 20+, and project build/test tools; the default is only a low-level runtime fallback and is not sufficient for BYO-key sandbox sessions ([issue #229](https://github.com/sagentlab/navarch/issues/229)). |
+| `NAVARCH_DOCKER_IMAGE` | `ghcr.io/sagentlab/navarch-sandbox-agent:0.1.0` | Version-pinned per-session image with Node 20, git, GitHub CLI, ripgrep, jq, SSH, and Claude Code 2.1.218. Override with an image tag or digest you control. |
 | `NAVARCH_AGENT` | saved choice, then `claude-code` | Local choice of agent CLI: `claude-code`, `codex`, or `gemini`. Overrides the choice saved by `connect`/`register`; `start --agent` has highest priority. |
 | `NAVARCH_RUNTIMES` | selected `NAVARCH_AGENT` | Comma list of installed/authenticated adapters advertised to dispatch. The control plane chooses among these per project/task. |
 | `NAVARCH_UPDATE_CHANNEL` | `stable` | Release channel advertised by the worker (`stable` or `canary`); the server-managed machine channel remains authoritative. |
 | `NAVARCH_AUTO_UPDATE` | on under `supervise` | Set `off`, `false`, or `0` to report releases without staging or activating them. Automatic activation is always off under plain `start`. |
 | `NAVARCH_CLAUDE_BIN` | `claude` | Path/name of the Claude Code CLI binary. |
-| `NAVARCH_CLAUDE_EXTRA_ARGS` | — | Comma list of extra CLI args appended after `--mcp-config` (Claude Code). `--allowedTools`/`--disallowedTools` layer rules onto auto mode; an explicit `--permission-mode`, `--permission-prompt-tool`, or bypass flag replaces the unattended default `--permission-mode auto`. |
+| `NAVARCH_CLAUDE_EXTRA_ARGS` | — | Comma list of extra CLI args appended after `--mcp-config` (Claude Code). `--allowedTools`/`--disallowedTools` layer rules onto auto mode; an explicit `--permission-mode`, `--permission-prompt-tool`, or bypass flag replaces the unattended default `--permission-mode auto`. Runtime sessions default to an empty `--setting-sources` list so machine/user/project hooks cannot leak into temporary checkouts; supply `--setting-sources=<sources>` here to opt in deliberately. |
 | `NAVARCH_CODEX_BIN` | `codex` | Path/name of the Codex CLI binary. |
 | `NAVARCH_CODEX_EXTRA_ARGS` | — | Comma list of extra CLI args appended after the generated MCP `-c` overrides and `--json` (Codex). |
 | `NAVARCH_GEMINI_BIN` | `gemini` | Path/name of the Google Gemini CLI binary. |
@@ -280,6 +280,9 @@ supported coding agents, using each CLI's native enforcement point:
   does not blanket-preapprove the lease-scoped Navarch MCP tools. A generated
   settings file (`src/worktree-guard.cts`, passed as `--settings`) also installs
   `bin/worktree-guard-hook.cjs` as a fail-closed `PreToolUse` boundary hook.
+  User, project, and local settings sources are disabled by default, preventing
+  host-only hooks and plugins from leaking into unattended sessions; the
+  explicit generated settings file remains active.
 - **Codex:** the runtime passes a one-off native permission profile with
   `approval_policy="on-request"` and `approvals_reviewer="auto_review"`.
   Codex's OS sandbox grants read/write access only to the allowed roots and

package/dist/adapter-capacity.cjs

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAdapterCapacityLimit = detectAdapterCapacityLimit;
+const exit_conditions_cjs_1 = require("./exit-conditions.cjs");
+const DEFAULT_CAPACITY_COOLDOWN_MS = 15 * 60 * 1000;
+const RESET_GRACE_MS = 30 * 1000;
+const MAX_RESET_SEARCH_MINUTES = 48 * 60;
+/**
+ * Detects a provider-side capacity response that applies beyond one task
+ * lease. Claude Code reports account session exhaustion as a successful CLI
+ * process containing a structured 429 result, so process exit status alone
+ * cannot distinguish it from an ordinary failed task.
+ */
+function detectAdapterCapacityLimit(result, nowMs = Date.now()) {
+    const parsed = (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stdout) ??
+        (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stderr);
+    if (parsed?.api_error_status !== 429)
+        return null;
+    const detail = parsed.result ?? "";
+    if (!/\b(?:session|usage|rate)\s+limit\b|\btoo many requests\b/i.test(detail)) {
+        return null;
+    }
+    return {
+        retryAtMs: parseResetTime(detail, nowMs) ??
+            nowMs + DEFAULT_CAPACITY_COOLDOWN_MS,
+    };
+}
+/**
+ * Resolves messages such as "resets 9:50pm (America/New_York)" without
+ * assuming the runtime host uses the provider's timezone. Searching minute
+ * boundaries also handles UTC offsets and daylight-saving transitions using
+ * the platform's IANA timezone database.
+ */
+function parseResetTime(detail, nowMs) {
+    const match = detail.match(/\bresets?\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(([^)]+)\)/i);
+    if (!match)
+        return null;
+    const hour12 = Number(match[1]);
+    const minute = Number(match[2] ?? "0");
+    const meridiem = match[3]?.toLowerCase();
+    const timeZone = match[4]?.trim();
+    if (!Number.isInteger(hour12) ||
+        hour12 < 1 ||
+        hour12 > 12 ||
+        !Number.isInteger(minute) ||
+        minute < 0 ||
+        minute > 59 ||
+        !timeZone) {
+        return null;
+    }
+    const targetHour = hour12 % 12 + (meridiem === "pm" ? 12 : 0);
+    let formatter;
+    try {
+        formatter = new Intl.DateTimeFormat("en-US", {
+            timeZone,
+            hour: "2-digit",
+            minute: "2-digit",
+            hourCycle: "h23",
+        });
+    }
+    catch {
+        return null;
+    }
+    const firstMinuteMs = Math.ceil((nowMs + 1) / 60_000) * 60_000;
+    for (let offset = 0; offset < MAX_RESET_SEARCH_MINUTES; offset += 1) {
+        const candidateMs = firstMinuteMs + offset * 60_000;
+        const parts = formatter.formatToParts(new Date(candidateMs));
+        const hour = Number(parts.find((part) => part.type === "hour")?.value);
+        const candidateMinute = Number(parts.find((part) => part.type === "minute")?.value);
+        if (hour === targetHour && candidateMinute === minute) {
+            return candidateMs + RESET_GRACE_MS;
+        }
+    }
+    return null;
+}

package/dist/adapters/claude.cjs

@@ -26,7 +26,22 @@ const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
  */
 async function runClaudeCodeAdapter(options) {
     const args = ["-p", options.prompt];
+    const hasSettingSources = options.extraArgs.some((arg) => arg === "--setting-sources" || arg.startsWith("--setting-sources="));
     const hasExplicitPermissionMode = options.extraArgs.some((arg) => ["--permission-mode", "--permission-prompt-tool", "--dangerously-skip-permissions"].some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
+    // Runtime sessions must not inherit an operator's personal or project-local
+    // Claude hooks. Apart from making execution machine-dependent, those hooks
+    // commonly reference helper files through CLAUDE_PROJECT_DIR; that variable
+    // points at the temporary session checkout, where a host-only helper does
+    // not exist, and a failing SessionEnd hook turns an otherwise successful
+    // task into an adapter failure.
+    //
+    // An empty source list disables user/project/local settings while preserving
+    // the explicit --settings file below ("flagSettings" in Claude Code), so the
+    // generated worktree-guard hook remains active. Operators can deliberately
+    // opt sources back in through NAVARCH_CLAUDE_EXTRA_ARGS.
+    if (!hasSettingSources) {
+        args.push("--setting-sources", "");
+    }
     // Navarch sessions are unattended, so route permission decisions through
     // Claude Code's native auto-mode classifier instead of prompting a human or
     // bypassing checks. Operators can replace this with a different permission

package/dist/claim-loop.cjs

@@ -23,6 +23,7 @@ class ClaimLoop {
     claimInFlight = false;
     consecutiveFailures = 0;
     nextClaimAt = 0;
+    capacityCooldownUntil = 0;
     quiescenceWaiters = new Set();
     constructor(api, config, capacity, runSession) {
         this.api = api;
@@ -60,7 +61,7 @@ class ClaimLoop {
         if (this.stopped ||
             this.claimInFlight ||
             !this.capacity.hasCapacity() ||
-            Date.now() < this.nextClaimAt)
+            Date.now() < Math.max(this.nextClaimAt, this.capacityCooldownUntil))
             return;
         this.claimInFlight = true;
         try {
@@ -85,6 +86,13 @@ class ClaimLoop {
             this.capacity.acquire(claimed.lease_id);
             log.info(`claimed task ${claimed.task.id} (${claimed.task.task_type}) as lease ${claimed.lease_id}, session ${sessionId}`);
             this.runSession(claimed, sessionId)
+                .then((outcome) => {
+                const cooldownUntil = outcome?.claimCooldownUntil;
+                if (!cooldownUntil || cooldownUntil <= Date.now())
+                    return;
+                this.capacityCooldownUntil = Math.max(this.capacityCooldownUntil, cooldownUntil);
+                log.warn(`adapter capacity exhausted; pausing new claims until ${new Date(this.capacityCooldownUntil).toISOString()}`);
+            })
                 .catch((err) => log.error(`session ${sessionId} failed: ${String(err)}`))
                 .finally(() => this.capacity.release(claimed.lease_id));
         }

package/dist/config.cjs

@@ -3,10 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SANDBOX_IMAGE = void 0;
 exports.isRuntimeAgentType = isRuntimeAgentType;
 exports.loadRuntimeConfig = loadRuntimeConfig;
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
+/** Published image containing git, GitHub CLI, and the pinned Claude Code CLI. */
+exports.DEFAULT_SANDBOX_IMAGE = "ghcr.io/sagentlab/navarch-sandbox-agent:0.1.0";
 function isRuntimeAgentType(value) {
     return value === "claude-code" || value === "codex" || value === "gemini";
 }
@@ -66,7 +69,7 @@ function loadRuntimeConfig(env = process.env) {
         gitAuthorEmail: env.NAVARCH_GIT_AUTHOR_EMAIL ?? "z@sagentlab.com",
         mcpConfigPath: env.NAVARCH_MCP_CONFIG_PATH ?? null,
         sandboxMode,
-        dockerImage: env.NAVARCH_DOCKER_IMAGE ?? "node:20-slim",
+        dockerImage: env.NAVARCH_DOCKER_IMAGE ?? exports.DEFAULT_SANDBOX_IMAGE,
         // Multiple sessions share one machine; keeping each agent inside its own
         // worktree is the safe default, so disabling is the explicit opt-out.
         worktreeGuard: !["off", "false", "0"].includes(env.NAVARCH_WORKTREE_GUARD ?? ""),

package/dist/session.cjs

@@ -19,6 +19,7 @@ const logger_cjs_1 = require("./logger.cjs");
 const git_worktree_cjs_1 = require("./git-worktree.cjs");
 const github_pr_cjs_1 = require("./github-pr.cjs");
 const worktree_guard_cjs_1 = require("./worktree-guard.cjs");
+const adapter_capacity_cjs_1 = require("./adapter-capacity.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
 const GIT_CREDENTIAL_HELPER_FILENAME = "git-credential-navarch.cjs";
@@ -129,6 +130,7 @@ async function runSession(deps, claimed, sessionId) {
     let leaseLost = false;
     let leaseGone = false;
     let heartbeatInFlight = null;
+    const sessionOutcome = {};
     const pollLease = () => {
         if (heartbeatInFlight)
             return heartbeatInFlight;
@@ -302,6 +304,10 @@ async function runSession(deps, claimed, sessionId) {
             });
             activeAbortController = null;
             attempts.push(turnResult);
+            const capacityLimit = (0, adapter_capacity_cjs_1.detectAdapterCapacityLimit)(turnResult);
+            if (capacityLimit) {
+                sessionOutcome.claimCooldownUntil = Math.max(sessionOutcome.claimCooldownUntil ?? 0, capacityLimit.retryAtMs);
+            }
             // Close the small race between a naturally completed turn and the next
             // scheduled heartbeat. If guidance landed, run another turn before the
             // lease can be completed. A terminal heartbeat response means the
@@ -311,7 +317,7 @@ async function runSession(deps, claimed, sessionId) {
                 await pollLease();
             if (leaseGone) {
                 log.warn(`session ${leaseId} stopped without completion because its lease is no longer active.`);
-                return;
+                return sessionOutcome;
             }
             if (!leaseLost && pendingGuidance.length > 0)
                 continue;
@@ -383,7 +389,7 @@ async function runSession(deps, claimed, sessionId) {
             catch (err) {
                 if (isAlreadyReleasedCompletionError(err)) {
                     log.warn(`completion skipped for ${leaseId}: the lease was already released.`);
-                    return;
+                    return sessionOutcome;
                 }
                 const rejection = mapping.leaseOutcome === "completed" ? completionRemediationMessage(err) : null;
                 if (!rejection)
@@ -432,6 +438,7 @@ async function runSession(deps, claimed, sessionId) {
         await gitWorktree.cleanup();
         await node_fs_1.promises.rm(workDir, { recursive: true, force: true }).catch(() => undefined);
     }
+    return sessionOutcome;
 }
 function adapterCommand(config, runtime) {
     switch (runtime) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",