@sagentlab/navarch-runtime 0.1.125 → 0.1.127

package/README.md

@@ -507,6 +507,50 @@ unchanged across the deployment.
 | `NAVARCH_CONVERSATION_MIRROR` | on | Seed new conversation checkouts from a per-repository mirror under `<workspaceRoot>/conversation-mirrors/` (fetch + local clone with independent object files) instead of a full network clone. Set `off` to always clone directly. |
 | `NAVARCH_CONVERSATION_TURN_TIMEOUT_MS` | `540000` | Time limit for one conversation turn's agent process (at most nine minutes). |
 | `NAVARCH_GUARD_EXTRA_ROOTS` | — | `path.delimiter`-separated (`:` on POSIX) extra directories the worktree guard allows beyond the session worktree, shared bare repo, and temp dirs. |
+| `NAVARCH_DEPENDENCY_CACHE` | `verify` | Comma-separated task types whose host-mode worktrees receive prepared `node_modules` from the lockfile-keyed dependency cache under `<workspaceRoot>/dependency-cache/` (see below). Set `off` to disable. |
+| `NAVARCH_DEPENDENCY_CACHE_TIMEOUT_MS` | `600000` | Time limit for one `npm ci` cache build. A timeout records the directory as not prepared; the session still starts. |
+
+## Dependency cache (host mode)
+
+Coding-agent sandboxes cannot reach a package registry, so a verify session
+could not install dependencies for local tests. Before the agent starts, the
+session manager (which is not sandboxed) prepares them
+(`src/dependency-cache.cts`):
+
+- It finds the tracked `package-lock.json` at the root and in first-level
+  directories (at most four) and handles each one separately.
+- The cache key is a SHA-256 over the repository, lockfile, `package.json`,
+  project `.npmrc`, Node and npm versions, platform, and architecture. Entries
+  never cross repositories.
+- It refuses repository content that could point npm at the host. Every
+  lockfile entry must be an HTTPS tarball with an `integrity` hash (no
+  `file:`, link, or git entries, lockfileVersion 2 or later). The project
+  `.npmrc` may set only `registry`, `@scope:registry`, and resolution rules
+  such as `legacy-peer-deps`. Inputs must be regular files, not symlinks.
+- On a miss it runs `npm ci --ignore-scripts --strict-ssl=true
+  --install-links=false` in a staging directory, with a per-repository npm
+  cache, writes `manifest.json`, and publishes the entry by rename. npm checks
+  each tarball against the lockfile `integrity`. No dependency code runs on
+  the host. npm gets an allowlisted environment without Navarch credentials or
+  provider tokens, but it reads the operator's `~/.npmrc`, so private registry
+  credentials there are used for the download.
+- It copies the entry into the worktree (copy-on-write where the filesystem
+  supports it), staging the copy in the session directory outside the
+  checkout, so a session cannot change the cached tree. The cache runs only
+  when the worktree guard is on, because the guard keeps the agent out of
+  `<workspaceRoot>/dependency-cache/`.
+- It writes only an absent `node_modules` that git ignores. npm workspaces
+  are skipped.
+- It keeps the two most recently used entries for each repository and lockfile
+  directory, removes entries unused for 14 days, never removes an entry used
+  in the last 30 minutes, and removes staging directories older than one day.
+  The per-repository npm tarball caches are not pruned.
+- The prompt gets a **Prepared dependencies** section and the log records each
+  result. A failure never stops the session.
+
+Docker mode is not covered: a tree built on the host does not match the
+image's platform. The `elevated-verification` profile with an enforcing
+`NAVARCH_SANDBOX_EGRESS_NETWORK` is the Docker path.
 
 ## Worktree boundary guard (host mode)
 
@@ -691,7 +735,9 @@ export NAVARCH_RUNTIMES=claude-code,codex,antigravity,opencode,acp,qoder,muse
 ```
 
 For the legacy single-runtime setting, priority is `start --agent` →
-`NAVARCH_AGENT` → the locally saved choice → `claude-code`.
+`NAVARCH_AGENT` → the locally saved choice → `claude-code`. An unrecognized
+`NAVARCH_AGENT` (for example `gemni`) is skipped with a warning that names it,
+so the saved choice still applies.
 `NAVARCH_RUNTIMES` expands what the worker advertises. For normal projects,
 the locally selected `NAVARCH_AGENT` handles every unpinned task. A task with a
 runtime override (for example `antigravity`) is claimed only by a worker that

package/dist/agent-types.cjs

@@ -0,0 +1,37 @@
+"use strict";
+// The one list of adapter ids. Every other adapter union in the runtime
+// (wire types in types.cts, AgentType in adapters/types.cts) derives from the
+// lists below, so adding an adapter here is the only edit that widens them.
+// Kept dependency-free so type-only importers (types.cts) and modules that
+// config.cts itself imports can read it without a module cycle.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_TYPES = exports.MANAGED_AGENT_TYPES = exports.RETIRED_AGENT_TYPES = exports.RUNTIME_AGENT_TYPES = void 0;
+exports.isRuntimeAgentType = isRuntimeAgentType;
+/**
+ * Adapter ids the runtime accepts for `NAVARCH_AGENT` / `--agent`, in display
+ * order. `NAVARCH_RUNTIMES` is validated against this same list, and the CLI
+ * usage/error copy is generated from it so the advertised set cannot drift.
+ */
+exports.RUNTIME_AGENT_TYPES = [
+    "claude-code",
+    "codex",
+    "antigravity",
+    "opencode",
+    "acp",
+    "qoder",
+    "muse",
+    "pi-local",
+];
+function isRuntimeAgentType(value) {
+    return typeof value === "string" && exports.RUNTIME_AGENT_TYPES.includes(value);
+}
+/**
+ * Retired adapters the control plane can still send (historical sessions and
+ * existing runtime pins). A machine never selects one locally: config.cts
+ * rejects `NAVARCH_AGENT=gemini` with migration guidance.
+ */
+exports.RETIRED_AGENT_TYPES = ["gemini"];
+/** Managed hosted runtimes (#885) that a BYO machine cannot advertise. */
+exports.MANAGED_AGENT_TYPES = ["pi"];
+/** Every adapter a session can run on, in support-matrix order. */
+exports.AGENT_TYPES = [...exports.RUNTIME_AGENT_TYPES, ...exports.RETIRED_AGENT_TYPES, ...exports.MANAGED_AGENT_TYPES];

package/dist/cli.cjs

@@ -72,12 +72,17 @@ function configFromFlags(flags, identity) {
     if (flags["config-dir"])
         env.NAVARCH_CONFIG_DIR = node_path_1.default.resolve(flags["config-dir"]);
     // Resolve the preferred adapter before deriving the advertised runtimes and
-    // applying host guards. Keep an explicit NAVARCH_RUNTIMES list intact.
-    const agentType = agentFromFlag(flags) ?? (env.NAVARCH_AGENT || identity?.agent_type);
+    // applying host guards. Keep an explicit NAVARCH_RUNTIMES list intact. An
+    // unrecognized NAVARCH_AGENT selects nothing, so the saved adapter still
+    // applies; the caller warns once with the id (warnUnknownAdapters).
+    const unknownAgent = (0, config_cjs_1.unknownAgentId)(env);
+    const agentType = agentFromFlag(flags) ?? ((unknownAgent ? undefined : env.NAVARCH_AGENT) || identity?.agent_type);
     if (agentType)
         env.NAVARCH_AGENT = agentType;
+    else
+        delete env.NAVARCH_AGENT;
     const config = (0, config_cjs_1.loadRuntimeConfig)(env);
-    return { ...config, model: modelFromFlags(flags, config.agentType, identity) };
+    return { ...config, unknownAgent, model: modelFromFlags(flags, config.agentType, identity) };
 }
 function agentFromFlag(flags) {
     const value = flags.agent;
@@ -97,18 +102,25 @@ function formatChoices(values) {
     return `${quoted.slice(0, -1).join(", ")}, or ${last}`;
 }
 /**
- * A typo in NAVARCH_RUNTIMES must not silently shrink the advertised adapter
- * set, so name every dropped id on stderr. Runs once per top-level command (not
- * per config load) to avoid duplicate lines when start/supervise/doctor resolve
- * the identity and reload config. A supervised worker inherits NAVARCH_RUNTIMES
- * from the `supervise` parent that already warned, so it stays quiet.
+ * A typo in NAVARCH_AGENT or NAVARCH_RUNTIMES must not silently change the
+ * selected adapter or shrink the advertised set, so name every dropped id on
+ * stderr. Runs once per top-level command (not per config load) to avoid
+ * duplicate lines when start/supervise/doctor resolve the identity and reload
+ * config. A supervised worker inherits both variables from the `supervise`
+ * parent that already warned, so it stays quiet.
  */
-function warnUnknownRuntimes(config) {
-    const unknown = config.unknownRuntimes;
-    if (config.supervised || unknown.length === 0)
+function warnUnknownAdapters(config) {
+    if (config.supervised)
         return;
-    log.warn(`NAVARCH_RUNTIMES ignores unrecognized adapter id(s): ${unknown.join(", ")}. ` +
-        `Known adapters: ${config_cjs_1.RUNTIME_AGENT_TYPES.join(", ")}.`);
+    const known = `Known adapters: ${config_cjs_1.RUNTIME_AGENT_TYPES.join(", ")}.`;
+    if (config.unknownAgent) {
+        const using = config.agentType ? ` Using ${config.agentType}.` : "";
+        log.warn(`NAVARCH_AGENT ignores unrecognized adapter id: '${config.unknownAgent}'.${using} ${known}`);
+    }
+    const unknown = config.unknownRuntimes;
+    if (unknown.length > 0) {
+        log.warn(`NAVARCH_RUNTIMES ignores unrecognized adapter id(s): ${unknown.join(", ")}. ${known}`);
+    }
 }
 /** Saved pins only apply to the adapter they were selected for. */
 function modelFromFlags(flags, agentType, identity) {
@@ -144,7 +156,7 @@ function parseArgs(argv) {
  */
 async function registerCommand(flags) {
     const config = configFromFlags(flags);
-    warnUnknownRuntimes(config);
+    warnUnknownAdapters(config);
     const apiBase = flags["api-base"] ?? config.apiBase;
     const enrollmentToken = flags.token ?? process.env.NAVARCH_ENROLLMENT_TOKEN;
     const name = flags.name ?? process.env.NAVARCH_MACHINE_NAME;
@@ -195,7 +207,7 @@ async function registerCommand(flags) {
  */
 async function connectCommand(flags) {
     const config = configFromFlags(flags);
-    warnUnknownRuntimes(config);
+    warnUnknownAdapters(config);
     const apiBase = flags["api-base"] ?? config.apiBase;
     const enrollmentToken = flags.token ?? process.env.NAVARCH_ENROLLMENT_TOKEN;
     const name = flags.name ?? process.env.NAVARCH_MACHINE_NAME;
@@ -239,7 +251,7 @@ async function startCommand(flags) {
     const baseConfig = configFromFlags(flags);
     const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(baseConfig.configDir, baseConfig.apiBase);
     const configuredConfig = configFromFlags(flags, identity);
-    warnUnknownRuntimes(configuredConfig);
+    warnUnknownAdapters(configuredConfig);
     // Probe before the first heartbeat or claim so browser-use is never
     // advertised on a machine whose agents cannot start a browser. The verdict
     // holds for this process; restarting the runtime probes again.
@@ -346,7 +358,7 @@ async function superviseCommand(flags) {
     const baseConfig = configFromFlags(flags);
     const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(baseConfig.configDir, baseConfig.apiBase);
     const config = configFromFlags(flags, identity);
-    warnUnknownRuntimes(config);
+    warnUnknownAdapters(config);
     // Resolve and pin the adapter before spawning the worker. The supervisor
     // passes machine credentials through the environment, so the child no
     // longer reads machine.json for identity fields (including agent_type).
@@ -385,14 +397,15 @@ async function doctorCommand(flags) {
         }
         if (identity)
             config = configFromFlags(flags, identity);
-        warnUnknownRuntimes(config);
+        warnUnknownAdapters(config);
     }
     catch (err) {
         // The typo may be why the config is unusable (e.g. `opencode,gemni` on a
         // guarded host leaves only OpenCode), so still name it.
-        warnUnknownRuntimes({
+        warnUnknownAdapters({
             supervised: process.env.NAVARCH_SUPERVISED === "1",
             unknownRuntimes: (0, config_cjs_1.unknownRuntimeIds)(process.env),
+            unknownAgent: (0, config_cjs_1.unknownAgentId)(process.env),
         });
         console.log(`config:          UNUSABLE — ${err instanceof Error ? err.message : String(err)}`);
         process.exitCode = 1;

package/dist/config.cjs

@@ -3,39 +3,35 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPENCODE_HOST_GUARD_MESSAGE = exports.ANTIGRAVITY_HOST_GUARD_MESSAGE = exports.RUNTIME_AGENT_TYPES = exports.DEFAULT_SANDBOX_IMAGE = void 0;
-exports.isRuntimeAgentType = isRuntimeAgentType;
+exports.OPENCODE_HOST_GUARD_MESSAGE = exports.ANTIGRAVITY_HOST_GUARD_MESSAGE = exports.isRuntimeAgentType = exports.RUNTIME_AGENT_TYPES = exports.DEFAULT_SANDBOX_IMAGE = void 0;
+exports.unknownAgentId = unknownAgentId;
 exports.unknownRuntimeIds = unknownRuntimeIds;
 exports.opencodeBlockedOnHost = opencodeBlockedOnHost;
 exports.loadRuntimeConfig = loadRuntimeConfig;
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
 const muse_cjs_1 = require("./adapters/muse.cjs");
+const agent_types_cjs_1 = require("./agent-types.cjs");
 const sandbox_profile_cjs_1 = require("./sandbox-profile.cjs");
 /** Published image containing git, GitHub CLI, and the pinned Claude Code CLI. */
 exports.DEFAULT_SANDBOX_IMAGE = "ghcr.io/sagentlab/navarch-sandbox-agent:0.1.0";
+var agent_types_cjs_2 = require("./agent-types.cjs");
+Object.defineProperty(exports, "RUNTIME_AGENT_TYPES", { enumerable: true, get: function () { return agent_types_cjs_2.RUNTIME_AGENT_TYPES; } });
+Object.defineProperty(exports, "isRuntimeAgentType", { enumerable: true, get: function () { return agent_types_cjs_2.isRuntimeAgentType; } });
 /**
- * Adapter ids the runtime accepts for `NAVARCH_AGENT` / `--agent`, in display
- * order. `NAVARCH_RUNTIMES` is validated against this same list, and the CLI
- * usage/error copy is generated from it so the advertised set cannot drift.
+ * NAVARCH_AGENT when it is set but names no known adapter. Retired ids
+ * (`gemini`) are not reported here: loadRuntimeConfig rejects them with
+ * migration guidance.
  */
-exports.RUNTIME_AGENT_TYPES = [
-    "claude-code",
-    "codex",
-    "antigravity",
-    "opencode",
-    "acp",
-    "qoder",
-    "muse",
-    "pi-local",
-];
-function isRuntimeAgentType(value) {
-    return typeof value === "string" && exports.RUNTIME_AGENT_TYPES.includes(value);
+function unknownAgentId(env) {
+    const value = env.NAVARCH_AGENT;
+    const retired = agent_types_cjs_1.RETIRED_AGENT_TYPES.includes(value ?? "");
+    return value && !retired && !(0, agent_types_cjs_1.isRuntimeAgentType)(value) ? value : undefined;
 }
 /** Unrecognized ids in NAVARCH_RUNTIMES, deduplicated, in the order given. */
 function unknownRuntimeIds(env) {
     const ids = envList(env, "NAVARCH_RUNTIMES", []);
-    return [...new Set(ids.filter((runtime) => !isRuntimeAgentType(runtime)))];
+    return [...new Set(ids.filter((runtime) => !(0, agent_types_cjs_1.isRuntimeAgentType)(runtime)))];
 }
 function envInt(env, name, fallback) {
     const raw = env[name];
@@ -101,7 +97,7 @@ function loadRuntimeConfig(env = process.env) {
     // prerequisite for claiming ordinary shell work.
     const sandboxMode = env.NAVARCH_SANDBOX_MODE === "docker" ? "docker" : "host";
     const defaultCapabilities = sandboxMode === "docker" ? ["docker-sandbox", "shell"] : ["shell", "browser-use"];
-    const requestedAgentType = isRuntimeAgentType(env.NAVARCH_AGENT) ? env.NAVARCH_AGENT : "claude-code";
+    const requestedAgentType = (0, agent_types_cjs_1.isRuntimeAgentType)(env.NAVARCH_AGENT) ? env.NAVARCH_AGENT : "claude-code";
     // Multiple sessions share one machine; keeping each agent inside its own
     // worktree is the safe default, so disabling is the explicit opt-out.
     const worktreeGuard = !["off", "false", "0"].includes(env.NAVARCH_WORKTREE_GUARD ?? "");
@@ -109,7 +105,7 @@ function loadRuntimeConfig(env = process.env) {
     // Keep unknown ids visible so a typo surfaces (CLI warns) instead of the
     // machine quietly shrinking the adapters it advertises.
     const unknownRuntimes = unknownRuntimeIds(env);
-    const requestedRuntimes = requestedRuntimeIds.filter(isRuntimeAgentType);
+    const requestedRuntimes = requestedRuntimeIds.filter(agent_types_cjs_1.isRuntimeAgentType);
     // OpenCode's CLI cannot express the host worktree boundary, so its adapter
     // fails closed there (adapters/opencode.cts). Advertising it anyway meant
     // the machine claimed OpenCode tasks it could only fail, one lease at a
@@ -157,6 +153,7 @@ function loadRuntimeConfig(env = process.env) {
         agentType,
         runtimes: runtimes.length > 0 ? runtimes : [agentType],
         unknownRuntimes,
+        unknownAgent: unknownAgentId(env),
         claudeBin: env.NAVARCH_CLAUDE_BIN ?? "claude",
         claudeExtraArgs: envList(env, "NAVARCH_CLAUDE_EXTRA_ARGS", []),
         codexBin: env.NAVARCH_CODEX_BIN ?? "codex",
@@ -192,6 +189,10 @@ function loadRuntimeConfig(env = process.env) {
             .split(node_path_1.default.delimiter)
             .map((s) => s.trim())
             .filter(Boolean),
+        dependencyCacheTaskTypes: env.NAVARCH_DEPENDENCY_CACHE?.trim().toLowerCase() === "off"
+            ? []
+            : envList(env, "NAVARCH_DEPENDENCY_CACHE", ["verify"]),
+        dependencyCacheTimeoutMs: envInt(env, "NAVARCH_DEPENDENCY_CACHE_TIMEOUT_MS", 10 * 60_000),
         updateChannel: env.NAVARCH_UPDATE_CHANNEL === "canary" ? "canary" : "stable",
         supervised: env.NAVARCH_SUPERVISED === "1",
         autoUpdate: env.NAVARCH_SUPERVISED === "1" &&

package/dist/conversation/capability.cjs

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.conversationCapability = conversationCapability;
 exports.conversationSupportMatrix = conversationSupportMatrix;
+const agent_types_cjs_1 = require("../agent-types.cjs");
 const index_cjs_1 = require("../adapters/index.cjs");
 /**
  * Whether this runtime can execute a Navi conversation turn, with the reason
@@ -40,8 +41,7 @@ function conversationCapability(config) {
 }
 /** Per-adapter support table for docs and diagnostics (host sandbox, guard on, feature enabled). */
 function conversationSupportMatrix() {
-    const agents = ["claude-code", "codex", "gemini", "antigravity", "opencode", "acp", "qoder", "muse", "pi-local", "pi"];
-    return agents.map((agentType) => ({
+    return agent_types_cjs_1.AGENT_TYPES.map((agentType) => ({
         agentType,
         capability: conversationCapability({
             agentType,

package/dist/dependency-cache.cjs

@@ -0,0 +1,566 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPENDENCY_CACHE_DIRNAME = void 0;
+exports.npmEnvironment = npmEnvironment;
+exports.prepareDependencyCache = prepareDependencyCache;
+exports.dependencyCacheKey = dependencyCacheKey;
+exports.renderDependencyCacheNote = renderDependencyCacheNote;
+exports.lockfileRefusal = lockfileRefusal;
+exports.npmrcRefusal = npmrcRefusal;
+exports.copyTree = copyTree;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const logger_cjs_1 = require("./logger.cjs");
+const sandbox_cjs_1 = require("./sandbox.cjs");
+/**
+ * Lockfile-keyed dependency cache for host-mode sessions (issue #667).
+ *
+ * A coding-agent sandbox has no npm registry egress (worktree-guard.cts allows
+ * GitHub only), so a fresh worktree cannot run `npm ci`. The session manager
+ * is not sandboxed, so before the agent starts it installs each tracked
+ * `package-lock.json` once with `npm ci --ignore-scripts`, keeps the result
+ * under `<workspaceRoot>/dependency-cache/<key>/`, and copies that tree into
+ * the worktree as the ignored `node_modules` directory.
+ *
+ * Policy, in one place:
+ * - Key: repository, lockfile, package.json and project .npmrc bytes, Node,
+ *   npm, platform and arch. A cache entry is never shared across
+ *   repositories, and any input change produces a new entry.
+ * - Lifecycle scripts never run. Dependency code does not execute on the
+ *   host; npm still checks every tarball against the lockfile's `integrity`.
+ * - Repository content cannot point npm at the host: every lockfile entry
+ *   must be an HTTPS tarball with an integrity hash (no `file:`, link, or git
+ *   entries), the project `.npmrc` may only choose registries and resolution
+ *   rules, inputs must be regular files, and TLS, link and log settings are
+ *   fixed on the command line. npm sees an allowlisted environment, but it
+ *   does read the operator's `~/.npmrc` so private registries keep working.
+ * - Entries are built in a temporary directory and published by rename, so a
+ *   partial install is never visible. The cache root is outside every
+ *   session's guard roots, and the worktree gets a copy (copy-on-write where
+ *   the filesystem supports it), so a session cannot change what the next
+ *   session receives.
+ * - Only an ignored, absent `node_modules` is written, so the copy cannot
+ *   become part of a commit or replace files the checkout already has.
+ * - npm workspaces are skipped: their install also writes into the
+ *   workspace packages, which a root-level copy does not reproduce.
+ *
+ * Every step degrades to a recorded `skipped`/`failed` result. Dependency
+ * preparation never fails the session.
+ */
+const log = (0, logger_cjs_1.createLogger)("dependency-cache");
+exports.DEPENDENCY_CACHE_DIRNAME = "dependency-cache";
+const MANIFEST_FILENAME = "manifest.json";
+const KEY_VERSION = 1;
+const LOCKFILE = "package-lock.json";
+/** At most this many lockfiles per worktree; deeper or extra ones are ignored. */
+const MAX_LOCKFILES = 4;
+const DEFAULT_TIMEOUT_MS = 10 * 60_000;
+/** Entries kept per repository + lockfile directory; older ones are pruned. */
+const DEFAULT_KEEP_PER_LOCKFILE = 2;
+const STALE_STAGING_MS = 24 * 60 * 60_000;
+/** Entries used this recently are never pruned: another session may be copying them. */
+const IN_USE_GRACE_MS = 30 * 60_000;
+/** Entries unused this long are pruned for any repository. */
+const UNUSED_ENTRY_MS = 14 * 24 * 60 * 60_000;
+/** Largest package.json / package-lock.json / .npmrc the cache reads. */
+const MAX_INPUT_BYTES = 64 * 1024 * 1024;
+/** Environment variables npm may see. Everything else (tokens, NAVARCH_*) is dropped. */
+const NPM_ENV_ALLOWLIST = [
+    "PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "TMPDIR",
+    "NVM_DIR", "NVM_BIN", "MISE_DATA_DIR", "XDG_DATA_HOME", "XDG_CONFIG_HOME",
+    "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy",
+    "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "SSL_CERT_DIR",
+];
+function npmEnvironment(env) {
+    const out = {};
+    for (const name of NPM_ENV_ALLOWLIST) {
+        if (env[name] !== undefined)
+            out[name] = env[name];
+    }
+    out.npm_config_update_notifier = "false";
+    out.npm_config_fund = "false";
+    out.npm_config_audit = "false";
+    return out;
+}
+async function prepareDependencyCache(options) {
+    const runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
+    const npmBin = options.npmBin ?? "npm";
+    const env = npmEnvironment(options.env ?? process.env);
+    const dirs = await trackedLockfileDirs(runner, options.worktreePath);
+    if (dirs.length === 0)
+        return [];
+    let npmVersion = null;
+    const results = [];
+    for (const dir of dirs) {
+        if (options.signal?.aborted)
+            break;
+        try {
+            const target = node_path_1.default.join(options.worktreePath, dir, "node_modules");
+            if (await exists(target)) {
+                results.push({ dir, status: "present" });
+                continue;
+            }
+            if (!(await isIgnored(runner, options.worktreePath, node_path_1.default.join(dir, "node_modules")))) {
+                results.push({ dir, status: "skipped", detail: "node_modules is not ignored by git in this checkout" });
+                continue;
+            }
+            const packageJson = await readInput(node_path_1.default.join(options.worktreePath, dir, "package.json"));
+            const lockfile = await readInput(node_path_1.default.join(options.worktreePath, dir, LOCKFILE));
+            const npmrc = await readInput(node_path_1.default.join(options.worktreePath, dir, ".npmrc"));
+            const unreadable = [packageJson, lockfile, npmrc].find((input) => input.state === "invalid");
+            if (unreadable?.state === "invalid") {
+                results.push({ dir, status: "skipped", detail: unreadable.detail });
+                continue;
+            }
+            if (packageJson.state !== "file" || lockfile.state !== "file") {
+                results.push({ dir, status: "skipped", detail: "no package.json next to package-lock.json" });
+                continue;
+            }
+            if (usesWorkspaces(packageJson.data)) {
+                results.push({ dir, status: "skipped", detail: "npm workspaces are not supported by the dependency cache" });
+                continue;
+            }
+            const refusal = lockfileRefusal(lockfile.data) ?? (npmrc.state === "file" ? npmrcRefusal(npmrc.data) : null);
+            if (refusal) {
+                results.push({ dir, status: "skipped", detail: refusal });
+                continue;
+            }
+            npmVersion ??= await readNpmVersion(runner, npmBin, env);
+            if (!npmVersion) {
+                results.push({ dir, status: "failed", detail: "npm is not available to the runtime" });
+                continue;
+            }
+            const inputs = {
+                packageJson: packageJson.data,
+                lockfile: lockfile.data,
+                npmrc: npmrc.state === "file" ? npmrc.data : null,
+            };
+            const key = dependencyCacheKey({
+                repository: options.repository,
+                dir,
+                ...inputs,
+                npmVersion,
+            });
+            const entry = node_path_1.default.join(options.cacheRoot, key);
+            const build = () => buildEntry({
+                ...options,
+                runner,
+                npmBin,
+                env,
+                dir,
+                key,
+                entry,
+                files: {
+                    "package.json": inputs.packageJson,
+                    [LOCKFILE]: inputs.lockfile,
+                    ...(inputs.npmrc ? { ".npmrc": inputs.npmrc } : {}),
+                },
+                manifest: {
+                    version: KEY_VERSION,
+                    key,
+                    repository: options.repository,
+                    dir,
+                    lockfile_sha256: sha256(inputs.lockfile),
+                    node: process.version,
+                    npm: npmVersion,
+                    platform: process.platform,
+                    arch: process.arch,
+                    lifecycle_scripts: "ignored",
+                    created_at: new Date().toISOString(),
+                },
+            });
+            let status = "hit";
+            let failure = null;
+            // A second pass covers an entry another session pruned between the
+            // publish check and the copy: the copy fails and the entry is rebuilt.
+            for (let attempt = 0; attempt < 2; attempt++) {
+                failure = null;
+                if (!(await isPublished(entry))) {
+                    failure = await build();
+                    if (failure)
+                        break;
+                    status = "built";
+                }
+                await touch(node_path_1.default.join(entry, MANIFEST_FILENAME));
+                try {
+                    await materialize(node_path_1.default.join(entry, "node_modules"), target, options.stagingDir);
+                    break;
+                }
+                catch (error) {
+                    if (attempt === 1 || (await isPublished(entry)))
+                        throw error;
+                    failure = "the cache entry was removed during the copy";
+                }
+            }
+            if (failure) {
+                results.push({ dir, status: "failed", key, detail: failure });
+                continue;
+            }
+            results.push({ dir, status, key });
+            await pruneEntries(options.cacheRoot, options.repository, dir, options.keepPerLockfile ?? DEFAULT_KEEP_PER_LOCKFILE)
+                .catch((error) => log.warn(`dependency cache prune failed: ${String(error)}`));
+        }
+        catch (error) {
+            results.push({ dir, status: "failed", detail: `unexpected error: ${error.message ?? String(error)}` });
+        }
+    }
+    return results;
+}
+function dependencyCacheKey(input) {
+    return sha256(Buffer.from(JSON.stringify({
+        v: KEY_VERSION,
+        repository: input.repository.toLowerCase(),
+        dir: input.dir,
+        lockfile: sha256(input.lockfile),
+        package_json: sha256(input.packageJson),
+        npmrc: input.npmrc ? sha256(input.npmrc) : null,
+        node: input.node ?? process.version,
+        npm: input.npmVersion,
+        platform: input.platform ?? process.platform,
+        arch: input.arch ?? process.arch,
+        scripts: "ignored",
+    })));
+}
+/**
+ * Prompt section that tells the agent what the runtime prepared. Returns null
+ * when the worktree has no tracked lockfile, so unrelated sessions see nothing.
+ */
+function renderDependencyCacheNote(results) {
+    if (results.length === 0)
+        return null;
+    const label = (dir) => (dir === "." ? "`node_modules`" : `\`${dir}/node_modules\``);
+    const ready = results.filter((r) => r.status === "hit" || r.status === "built");
+    const notReady = results.filter((r) => r.status === "skipped" || r.status === "failed");
+    const lines = ["## Prepared dependencies", ""];
+    if (ready.length > 0) {
+        lines.push(`Navarch installed locked dependencies before this session started: ${ready.map((r) => `${label(r.dir)} (cache ${r.status === "hit" ? "hit" : "built"}, key \`${r.key.slice(0, 12)}\`)`).join(", ")}.`, "The runtime ran `npm ci --ignore-scripts` outside the sandbox, keyed on the repository, `package-lock.json`, `package.json`, `.npmrc`, Node, npm, and platform, and copied the result into this checkout.", "Use these directories for local tests, type checks, and builds. Do not run `npm ci` or `npm install`: the sandbox has no registry access.", "Lifecycle scripts did not run. If a step fails because a package needs its install script (for example a native addon build), report that exact package and command as a capability gap.");
+    }
+    for (const r of results.filter((result) => result.status === "present")) {
+        lines.push(`${label(r.dir)} was already in the checkout, so the runtime left it unchanged.`);
+    }
+    for (const r of notReady) {
+        lines.push(`${label(r.dir)} was not prepared (${r.status}): ${r.detail ?? "no detail"}.`);
+    }
+    return lines.join("\n");
+}
+async function trackedLockfileDirs(runner, worktreePath) {
+    const listed = await runner.run("git", ["-C", worktreePath, "ls-files", "-z", "--", LOCKFILE, `*/${LOCKFILE}`], { timeoutMs: 30_000 });
+    if (listed.code !== 0)
+        return [];
+    const dirs = listed.stdout
+        .split("\0")
+        .filter(Boolean)
+        .map((file) => node_path_1.default.posix.dirname(file))
+        // Root and first-level packages only, never a vendored node_modules copy.
+        .filter((dir) => dir === "." || (!dir.includes("/") && dir !== "node_modules"));
+    return [...new Set(dirs)].sort((a, b) => (a === "." ? -1 : b === "." ? 1 : a.localeCompare(b))).slice(0, MAX_LOCKFILES);
+}
+async function isIgnored(runner, worktreePath, relativePath) {
+    const result = await runner.run("git", ["-C", worktreePath, "check-ignore", "-q", "--", `${relativePath.split(node_path_1.default.sep).join("/")}/`], { timeoutMs: 30_000 });
+    return result.code === 0;
+}
+/**
+ * Why a lockfile cannot be installed outside the checkout, or null.
+ *
+ * npm resolves `file:` and link entries relative to the staging directory and
+ * reads any host path they name, so a crafted lockfile could copy host files
+ * (other sessions, other repositories) into this checkout. Only registry
+ * tarballs fetched over HTTPS and pinned by `integrity` are accepted; bundled
+ * dependencies ship inside such a tarball.
+ */
+function lockfileRefusal(lockfile) {
+    let parsed;
+    try {
+        parsed = JSON.parse(lockfile.toString("utf8"));
+    }
+    catch {
+        return "package-lock.json is not valid JSON";
+    }
+    if (typeof parsed.lockfileVersion !== "number" || parsed.lockfileVersion < 2
+        || typeof parsed.packages !== "object" || parsed.packages === null) {
+        return "package-lock.json must be lockfileVersion 2 or later";
+    }
+    for (const [location, value] of Object.entries(parsed.packages)) {
+        if (location === "")
+            continue;
+        const entry = (typeof value === "object" && value !== null ? value : {});
+        const segments = location.split("/");
+        if (segments[0] !== "node_modules" || segments.includes("..") || segments.includes(".")) {
+            return `package-lock.json entry "${location.slice(0, 120)}" is outside node_modules`;
+        }
+        if (entry.link === true)
+            return `package-lock.json entry "${location.slice(0, 120)}" is a link`;
+        if (entry.inBundle === true)
+            continue;
+        if (typeof entry.resolved !== "string" || !entry.resolved.startsWith("https://")) {
+            return `package-lock.json entry "${location.slice(0, 120)}" does not resolve to an HTTPS registry tarball`;
+        }
+        if (typeof entry.integrity !== "string" || entry.integrity === "") {
+            return `package-lock.json entry "${location.slice(0, 120)}" has no integrity hash`;
+        }
+    }
+    return null;
+}
+/** Project `.npmrc` keys that only choose a registry or resolution rules. */
+const NPMRC_ALLOWED_KEYS = new Set([
+    "registry",
+    "legacy-peer-deps",
+    "strict-peer-deps",
+    "engine-strict",
+    "save-exact",
+    "save-prefix",
+    "fund",
+    "audit",
+    "update-notifier",
+]);
+/**
+ * Why a project `.npmrc` cannot be used by the unsandboxed npm, or null.
+ * Keys such as `strict-ssl`, `https-proxy`, `cafile`, `git`, `install-links`,
+ * or `logs-dir` would let repository content change how npm uses the host's
+ * network and credentials, so any key outside the allowlist skips the cache.
+ */
+function npmrcRefusal(npmrc) {
+    for (const raw of npmrc.toString("utf8").split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line === "" || line.startsWith("#") || line.startsWith(";"))
+            continue;
+        const key = line.split("=", 1)[0].trim();
+        if (NPMRC_ALLOWED_KEYS.has(key) || /^@[^/:\s]+:registry$/.test(key))
+            continue;
+        return `.npmrc sets "${key}", which the dependency cache does not allow`;
+    }
+    return null;
+}
+function usesWorkspaces(packageJson) {
+    try {
+        const parsed = JSON.parse(packageJson.toString("utf8"));
+        return parsed.workspaces !== undefined;
+    }
+    catch {
+        // npm ci reports an invalid package.json itself.
+        return false;
+    }
+}
+async function readNpmVersion(runner, npmBin, env) {
+    try {
+        const result = await runner.run(npmBin, ["--version"], { timeoutMs: 30_000, env });
+        const version = result.stdout.trim();
+        return result.code === 0 && version ? version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Builds and publishes one entry. Returns a failure detail, or null on success. */
+async function buildEntry(input) {
+    await node_fs_1.promises.mkdir(input.cacheRoot, { recursive: true, mode: 0o700 });
+    const staging = node_path_1.default.join(input.cacheRoot, `.tmp-${input.key.slice(0, 16)}-${(0, node_crypto_1.randomBytes)(4).toString("hex")}`);
+    await node_fs_1.promises.mkdir(staging, { mode: 0o700 });
+    try {
+        for (const [name, contents] of Object.entries(input.files)) {
+            await node_fs_1.promises.writeFile(node_path_1.default.join(staging, name), contents);
+        }
+        const started = Date.now();
+        const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        // npm's own tarball store is per repository too, so a private package
+        // fetched for one repository is never served to another.
+        const repositoryTag = sha256(Buffer.from(input.manifest.repository.toLowerCase())).slice(0, 16);
+        const result = await input.runner.run(input.npmBin, [
+            "ci",
+            "--ignore-scripts",
+            "--no-audit",
+            "--no-fund",
+            "--strict-ssl=true",
+            "--install-links=false",
+            "--cache",
+            node_path_1.default.join(input.cacheRoot, `.npm-${repositoryTag}`),
+            "--logs-dir",
+            node_path_1.default.join(input.cacheRoot, ".logs"),
+        ], { cwd: staging, env: input.env, timeoutMs, signal: input.signal });
+        if (result.code !== 0) {
+            log.warn(`npm ci for ${input.dir} (key ${input.key.slice(0, 12)}) exited ${result.code}: ${tail(result.stderr || result.stdout)}`);
+            if (input.signal?.aborted)
+                return "the session stopped before npm ci finished";
+            if (result.code === -1) {
+                return Date.now() - started >= timeoutMs
+                    ? "npm ci did not finish before the dependency-cache timeout"
+                    : "npm ci was stopped by a signal";
+            }
+            return `npm ci exited with code ${result.code}`;
+        }
+        if (!(await exists(node_path_1.default.join(staging, "node_modules")))) {
+            await node_fs_1.promises.mkdir(node_path_1.default.join(staging, "node_modules"));
+        }
+        for (const name of Object.keys(input.files))
+            await node_fs_1.promises.rm(node_path_1.default.join(staging, name), { force: true });
+        await node_fs_1.promises.writeFile(node_path_1.default.join(staging, MANIFEST_FILENAME), `${JSON.stringify(input.manifest, null, 2)}\n`);
+        try {
+            await node_fs_1.promises.rename(staging, input.entry);
+        }
+        catch (error) {
+            // Another session published the same key first; its tree is equivalent.
+            if (!(await isPublished(input.entry)))
+                throw error;
+        }
+        log.info(`built dependency cache ${input.key.slice(0, 12)} for ${input.dir} in ${Math.round((Date.now() - started) / 1000)}s`);
+        return null;
+    }
+    finally {
+        await node_fs_1.promises.rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/** Copies the cached tree in under a temporary name, then renames it into place. */
+async function materialize(source, target, stagingDir) {
+    const staging = stagingDir
+        ? node_path_1.default.join(stagingDir, `node_modules.navarch-${(0, node_crypto_1.randomBytes)(4).toString("hex")}`)
+        : `${target}.navarch-${(0, node_crypto_1.randomBytes)(4).toString("hex")}`;
+    try {
+        await copyTree(source, staging);
+        await node_fs_1.promises.rename(staging, target);
+    }
+    finally {
+        await node_fs_1.promises.rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/** Files copied at once. A node_modules tree is tens of thousands of small files. */
+const COPY_CONCURRENCY = 32;
+/**
+ * Recursive copy with file copies in parallel, copy-on-write where the
+ * filesystem supports it. `fs.cp` copies one file at a time, which made a
+ * 1 GB tree take about 90 s instead of about 8 s. Symlinks are recreated with
+ * their original (relative) targets; `copyFile` keeps each file's mode.
+ */
+async function copyTree(source, target) {
+    const files = [];
+    const links = [];
+    const walk = async (relative) => {
+        await node_fs_1.promises.mkdir(node_path_1.default.join(target, relative), { recursive: true });
+        const subdirs = [];
+        for (const dirent of await node_fs_1.promises.readdir(node_path_1.default.join(source, relative), { withFileTypes: true })) {
+            const child = node_path_1.default.join(relative, dirent.name);
+            if (dirent.isDirectory())
+                subdirs.push(child);
+            else if (dirent.isSymbolicLink())
+                links.push(child);
+            else if (dirent.isFile())
+                files.push(child);
+        }
+        for (const subdir of subdirs)
+            await walk(subdir);
+    };
+    await walk("");
+    let next = 0;
+    const worker = async () => {
+        for (let relative = files[next++]; relative !== undefined; relative = files[next++]) {
+            await node_fs_1.promises.copyFile(node_path_1.default.join(source, relative), node_path_1.default.join(target, relative), node_fs_1.constants.COPYFILE_FICLONE);
+        }
+    };
+    await Promise.all(Array.from({ length: COPY_CONCURRENCY }, worker));
+    for (const relative of links) {
+        await node_fs_1.promises.symlink(await node_fs_1.promises.readlink(node_path_1.default.join(source, relative)), node_path_1.default.join(target, relative));
+    }
+}
+async function pruneEntries(cacheRoot, repository, dir, keep) {
+    const now = Date.now();
+    const entries = await node_fs_1.promises.readdir(cacheRoot, { withFileTypes: true });
+    const matching = [];
+    const expired = [];
+    for (const dirent of entries) {
+        if (dirent.isDirectory() && dirent.name.startsWith(".tmp-")) {
+            // Staging left behind by a crashed runtime; a live build is far younger.
+            const staging = node_path_1.default.join(cacheRoot, dirent.name);
+            const stat = await node_fs_1.promises.stat(staging).catch(() => null);
+            if (stat && now - stat.mtimeMs > STALE_STAGING_MS) {
+                await node_fs_1.promises.rm(staging, { recursive: true, force: true }).catch(() => undefined);
+            }
+            continue;
+        }
+        if (!dirent.isDirectory() || dirent.name.startsWith("."))
+            continue;
+        const entry = node_path_1.default.join(cacheRoot, dirent.name);
+        const manifestPath = node_path_1.default.join(entry, MANIFEST_FILENAME);
+        try {
+            const manifest = JSON.parse(await node_fs_1.promises.readFile(manifestPath, "utf8"));
+            const usedAt = (await node_fs_1.promises.stat(manifestPath)).mtimeMs;
+            // An entry another session touched recently may be mid-copy.
+            if (now - usedAt < IN_USE_GRACE_MS)
+                continue;
+            if (now - usedAt > UNUSED_ENTRY_MS)
+                expired.push(entry);
+            else if (manifest.repository?.toLowerCase() === repository.toLowerCase() && manifest.dir === dir) {
+                matching.push({ entry, usedAt });
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    // `keep` counts the entry this session just used, which the grace period skipped.
+    matching.sort((a, b) => b.usedAt - a.usedAt);
+    const stale = [...matching.slice(Math.max(keep - 1, 0)).map((m) => m.entry), ...expired];
+    for (const entry of stale) {
+        // Rename first so a concurrent reader never sees a half-deleted entry as published.
+        const doomed = node_path_1.default.join(cacheRoot, `.tmp-prune-${(0, node_crypto_1.randomBytes)(4).toString("hex")}`);
+        try {
+            await node_fs_1.promises.rename(entry, doomed);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue; // Another prune won.
+            throw error;
+        }
+        await node_fs_1.promises.rm(doomed, { recursive: true, force: true });
+    }
+}
+async function isPublished(entry) {
+    return (await exists(node_path_1.default.join(entry, MANIFEST_FILENAME))) && (await exists(node_path_1.default.join(entry, "node_modules")));
+}
+async function exists(target) {
+    try {
+        await node_fs_1.promises.lstat(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Reads an install input without following a symlink, so a planted link
+ * cannot stage a host file, block on a FIFO, or stream /dev/zero.
+ */
+async function readInput(file) {
+    let stat;
+    try {
+        stat = await node_fs_1.promises.lstat(file);
+    }
+    catch {
+        return { state: "absent" };
+    }
+    const name = node_path_1.default.basename(file);
+    if (!stat.isFile())
+        return { state: "invalid", detail: `${name} is not a regular file` };
+    if (stat.size > MAX_INPUT_BYTES)
+        return { state: "invalid", detail: `${name} is larger than 64 MB` };
+    const handle = await node_fs_1.promises.open(file, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+    try {
+        return { state: "file", data: await handle.readFile() };
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function touch(file) {
+    const now = new Date();
+    await node_fs_1.promises.utimes(file, now, now).catch(() => undefined);
+}
+function sha256(data) {
+    return (0, node_crypto_1.createHash)("sha256").update(data).digest("hex");
+}
+function tail(text) {
+    const trimmed = text.trim();
+    return trimmed.length > 500 ? `…${trimmed.slice(-500)}` : trimmed;
+}

package/dist/github-credential.cjs

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_CREDENTIAL_SECRET_NAME = void 0;
+exports.githubCredentialDenialSummary = githubCredentialDenialSummary;
+/** Wire name the session requests its repository credential under. */
+exports.GITHUB_CREDENTIAL_SECRET_NAME = "github-pat";
+/**
+ * Denials that mean no repository credential exists for this lease, rather
+ * than one being refused: the project has neither a GitHub App installation
+ * nor a `github-pat` secret (`not_found`), or a standalone PR review on a
+ * PAT-connected project, which deliberately gets none
+ * (`standalone_review_read_only`). The machine's own git login has always
+ * been the clone credential then, so those sessions keep running.
+ */
+const NO_CREDENTIAL_REASONS = new Set(["not_found", "standalone_review_read_only"]);
+const MEMBER_FIX = "or have a project owner move this agent to the project GitHub identity, then resume the agent on the Agents page.";
+const REASON_TEXT = {
+    member_github_missing: `this agent acts as a project member whose GitHub account is not connected. Connect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_github_revoked: `this agent acts as a project member whose GitHub authorization was revoked. Reconnect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_github_unavailable: `this agent acts as a project member whose GitHub credential could not be read. Reconnect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_not_in_project: `this agent acts as a member who does not belong to this project. Add them to the project, ${MEMBER_FIX}`,
+};
+/**
+ * The failure summary for a lease whose repository credential the broker
+ * refused, or null when the session may proceed.
+ *
+ * Without this check a refused credential left the clone to whatever git
+ * credential helper the host had configured — on pebble-agent-1721
+ * (2026-10-21) that was `gh auth git-credential` for an account that cannot
+ * see the repository, so every claim failed with an unexplained "Repository
+ * not found". The summary leads with `GitHub credential denied (<reason>):`,
+ * which the control plane's failure attribution anchors on to pause the
+ * machine instead of spending the task's retries
+ * (lib/navarch/failure-attribution.ts MEMBER_GITHUB_RULE).
+ */
+function githubCredentialDenialSummary(denied) {
+    const denial = denied?.find((entry) => entry.name === exports.GITHUB_CREDENTIAL_SECRET_NAME);
+    if (!denial || NO_CREDENTIAL_REASONS.has(denial.reason))
+        return null;
+    const explanation = REASON_TEXT[denial.reason] ?? "the control plane refused the repository credential for this lease.";
+    return (`GitHub credential denied (${denial.reason}): ${explanation} ` +
+        "The session stopped before cloning instead of falling back to this machine's own git login.");
+}

package/dist/machine-store.cjs

@@ -8,7 +8,7 @@ exports.loadMachineIdentity = loadMachineIdentity;
 exports.resolveMachineIdentity = resolveMachineIdentity;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
-const config_cjs_1 = require("./config.cjs");
+const agent_types_cjs_1 = require("./agent-types.cjs");
 function storePath(configDir) {
     return node_path_1.default.join(configDir, "machine.json");
 }
@@ -52,7 +52,7 @@ async function resolveMachineIdentity(configDir, apiBaseFallback) {
             // Validate against the one accepted adapter list so a new adapter cannot
             // be added to `--agent`/NAVARCH_AGENT while this env-based identity path
             // silently drops it.
-            agent_type: (0, config_cjs_1.isRuntimeAgentType)(process.env.NAVARCH_AGENT)
+            agent_type: (0, agent_types_cjs_1.isRuntimeAgentType)(process.env.NAVARCH_AGENT)
                 ? process.env.NAVARCH_AGENT
                 : undefined,
         };

package/dist/session.cjs

@@ -22,6 +22,7 @@ const mcp_config_cjs_1 = require("./mcp-config.cjs");
 const user_mcp_servers_cjs_1 = require("./user-mcp-servers.cjs");
 const logger_cjs_1 = require("./logger.cjs");
 const git_worktree_cjs_1 = require("./git-worktree.cjs");
+const dependency_cache_cjs_1 = require("./dependency-cache.cjs");
 const worktree_janitor_cjs_1 = require("./worktree-janitor.cjs");
 const session_processes_cjs_1 = require("./session-processes.cjs");
 const github_pr_cjs_1 = require("./github-pr.cjs");
@@ -33,6 +34,7 @@ const completion_retry_cjs_1 = require("./completion-retry.cjs");
 const adapter_capacity_cjs_1 = require("./adapter-capacity.cjs");
 const agent_auth_cjs_1 = require("./agent-auth.cjs");
 const agent_model_cjs_1 = require("./agent-model.cjs");
+const github_credential_cjs_1 = require("./github-credential.cjs");
 const browser_evidence_cjs_1 = require("./browser-evidence.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
@@ -163,6 +165,24 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         secrets = issued.secrets;
         managedGithubCredential = issued.github_app_issued === true;
         registry.registerAll(secrets);
+        const credentialDenial = (0, github_credential_cjs_1.githubCredentialDenialSummary)(issued.denied);
+        if (credentialDenial) {
+            log.error(`session ${leaseId}: ${credentialDenial}`);
+            await api.completeLease(leaseId, {
+                status: "failed",
+                report: credentialDenial,
+                failure_summary: credentialDenial,
+                failed_before_start: true,
+                evidence_urls: [],
+                cost: { tokens_in: 0, tokens_out: 0, cost_usd: 0 },
+                exit_status: "crashed",
+                agent_type: runtime,
+                ...executionReport,
+            });
+            secrets = {};
+            await node_fs_1.promises.rm(workDir, { recursive: true, force: true }).catch(() => undefined);
+            return;
+        }
     }
     let gitCredentialRefresh;
     if (managedGithubCredential && secrets["github-pat"]) {
@@ -523,6 +543,43 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             promptText = `${promptText}\n\n${(0, prompt_cjs_1.renderHostedCheckpointNote)(restoredCheckpoint, gitWorktree.branch)}`;
             await node_fs_1.promises.writeFile(node_path_1.default.join(workDir, "prompt.md"), promptText, "utf8");
         }
+        // The sandbox cannot reach a package registry, so the unsandboxed session
+        // manager installs locked dependencies for the selected task types
+        // (dependency-cache.cts). Host mode only: a host-built tree does not match
+        // a Docker image's platform. The worktree guard is what keeps the agent
+        // out of the shared cache, so an unguarded session gets no cache.
+        if (config.sandboxMode === "host" && config.worktreeGuard
+            && config.dependencyCacheTaskTypes.includes(task.task_type)) {
+            const dependencyAbort = new AbortController();
+            activeAbortController = dependencyAbort;
+            if (leaseLost || deps.shutdownSignal?.aborted)
+                dependencyAbort.abort();
+            const dependencyResults = await (0, dependency_cache_cjs_1.prepareDependencyCache)({
+                cacheRoot: node_path_1.default.join(config.workspaceRoot, dependency_cache_cjs_1.DEPENDENCY_CACHE_DIRNAME),
+                worktreePath: gitWorktree.worktreePath,
+                stagingDir: workDir,
+                repository: task.repo,
+                timeoutMs: config.dependencyCacheTimeoutMs,
+                signal: dependencyAbort.signal,
+            }).catch((error) => {
+                log.warn(`dependency cache for ${leaseId} failed: ${(0, redact_cjs_1.redactText)(String(error), registry.list())}`);
+                return [];
+            });
+            activeAbortController = null;
+            for (const result of dependencyResults) {
+                const message = `dependency cache for ${leaseId} ${result.dir}: ${result.status}` +
+                    `${result.key ? ` (key ${result.key.slice(0, 12)})` : ""}${result.detail ? ` — ${result.detail}` : ""}`;
+                if (result.status === "failed")
+                    log.warn(message);
+                else
+                    log.info(message);
+            }
+            const dependencyNote = (0, dependency_cache_cjs_1.renderDependencyCacheNote)(dependencyResults);
+            if (dependencyNote) {
+                promptText = `${promptText}\n\n${dependencyNote}`;
+                await node_fs_1.promises.writeFile(node_path_1.default.join(workDir, "prompt.md"), promptText, "utf8");
+            }
+        }
         // Preparation may resume an existing task branch with an older slug or ID format.
         if (!allowBranchRename) {
             sessionEnv.NAVARCH_DELIVERY_BRANCH = gitWorktree.branch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.125",
+  "version": "0.1.127",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",