@sagentlab/navarch-runtime 0.1.126 → 0.1.127

package/dist/github-credential.cjs

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_CREDENTIAL_SECRET_NAME = void 0;
+exports.githubCredentialDenialSummary = githubCredentialDenialSummary;
+/** Wire name the session requests its repository credential under. */
+exports.GITHUB_CREDENTIAL_SECRET_NAME = "github-pat";
+/**
+ * Denials that mean no repository credential exists for this lease, rather
+ * than one being refused: the project has neither a GitHub App installation
+ * nor a `github-pat` secret (`not_found`), or a standalone PR review on a
+ * PAT-connected project, which deliberately gets none
+ * (`standalone_review_read_only`). The machine's own git login has always
+ * been the clone credential then, so those sessions keep running.
+ */
+const NO_CREDENTIAL_REASONS = new Set(["not_found", "standalone_review_read_only"]);
+const MEMBER_FIX = "or have a project owner move this agent to the project GitHub identity, then resume the agent on the Agents page.";
+const REASON_TEXT = {
+    member_github_missing: `this agent acts as a project member whose GitHub account is not connected. Connect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_github_revoked: `this agent acts as a project member whose GitHub authorization was revoked. Reconnect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_github_unavailable: `this agent acts as a project member whose GitHub credential could not be read. Reconnect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_not_in_project: `this agent acts as a member who does not belong to this project. Add them to the project, ${MEMBER_FIX}`,
+};
+/**
+ * The failure summary for a lease whose repository credential the broker
+ * refused, or null when the session may proceed.
+ *
+ * Without this check a refused credential left the clone to whatever git
+ * credential helper the host had configured — on pebble-agent-1721
+ * (2026-10-21) that was `gh auth git-credential` for an account that cannot
+ * see the repository, so every claim failed with an unexplained "Repository
+ * not found". The summary leads with `GitHub credential denied (<reason>):`,
+ * which the control plane's failure attribution anchors on to pause the
+ * machine instead of spending the task's retries
+ * (lib/navarch/failure-attribution.ts MEMBER_GITHUB_RULE).
+ */
+function githubCredentialDenialSummary(denied) {
+    const denial = denied?.find((entry) => entry.name === exports.GITHUB_CREDENTIAL_SECRET_NAME);
+    if (!denial || NO_CREDENTIAL_REASONS.has(denial.reason))
+        return null;
+    const explanation = REASON_TEXT[denial.reason] ?? "the control plane refused the repository credential for this lease.";
+    return (`GitHub credential denied (${denial.reason}): ${explanation} ` +
+        "The session stopped before cloning instead of falling back to this machine's own git login.");
+}

package/dist/session.cjs

@@ -34,6 +34,7 @@ const completion_retry_cjs_1 = require("./completion-retry.cjs");
 const adapter_capacity_cjs_1 = require("./adapter-capacity.cjs");
 const agent_auth_cjs_1 = require("./agent-auth.cjs");
 const agent_model_cjs_1 = require("./agent-model.cjs");
+const github_credential_cjs_1 = require("./github-credential.cjs");
 const browser_evidence_cjs_1 = require("./browser-evidence.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
@@ -164,6 +165,24 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         secrets = issued.secrets;
         managedGithubCredential = issued.github_app_issued === true;
         registry.registerAll(secrets);
+        const credentialDenial = (0, github_credential_cjs_1.githubCredentialDenialSummary)(issued.denied);
+        if (credentialDenial) {
+            log.error(`session ${leaseId}: ${credentialDenial}`);
+            await api.completeLease(leaseId, {
+                status: "failed",
+                report: credentialDenial,
+                failure_summary: credentialDenial,
+                failed_before_start: true,
+                evidence_urls: [],
+                cost: { tokens_in: 0, tokens_out: 0, cost_usd: 0 },
+                exit_status: "crashed",
+                agent_type: runtime,
+                ...executionReport,
+            });
+            secrets = {};
+            await node_fs_1.promises.rm(workDir, { recursive: true, force: true }).catch(() => undefined);
+            return;
+        }
     }
     let gitCredentialRefresh;
     if (managedGithubCredential && secrets["github-pat"]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.126",
+  "version": "0.1.127",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",