@sagentlab/navarch-runtime 0.1.126 → 0.1.128

package/bin/git-credential-navarch-grant.cjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+
+// Git credential helper for sessions that use a Navarch git grant. The runtime
+// parent process refreshes the grant file; this helper only reads it, so it
+// makes no network call and holds no machine token. Usage (as configured in
+// GIT_CONFIG_*): `node git-credential-navarch-grant.cjs <grant-file> get`.
+
+const fs = require("node:fs");
+
+const grantFile = process.argv[2];
+const operation = process.argv[3];
+if (operation !== "get") process.exit(0);
+
+if (!grantFile) {
+  console.error("navarch git grant helper is missing the grant file path");
+  process.exit(1);
+}
+
+let grant;
+try {
+  grant = fs.readFileSync(grantFile, "utf8").trim();
+} catch (error) {
+  console.error(`navarch git grant is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+  process.exit(1);
+}
+if (!grant || /[\r\n\0]/.test(grant)) {
+  console.error("navarch git grant file is empty or malformed");
+  process.exit(1);
+}
+process.stdout.write(`username=navarch\npassword=${grant}\n`);

package/dist/api.cjs

@@ -158,6 +158,17 @@ class NavarchApiClient {
             throw new Error("issueSecrets: empty response from control plane.");
         return result;
     }
+    /**
+     * `POST /api/broker/grant {lease_id}`: a signed, short-lived git grant for the
+     * Navarch git/gh proxy. A project in mode `off` answers 409 `git_proxy_disabled`.
+     */
+    async issueGitGrant(leaseId) {
+        const result = await this.request("POST", "/api/broker/grant", { lease_id: leaseId });
+        if (!result || typeof result.grant !== "string" || !result.proxy_host || !result.proxy_base_url) {
+            throw new Error("issueGitGrant: incomplete response from control plane.");
+        }
+        return result;
+    }
     /** `POST /api/broker/mcp-servers {lease_id}`: the user-attached MCP servers this lease's session should connect to. */
     async fetchUserMcpServers(leaseId) {
         const result = await this.request("POST", "/api/broker/mcp-servers", { lease_id: leaseId });

package/dist/config.cjs

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPENCODE_HOST_GUARD_MESSAGE = exports.ANTIGRAVITY_HOST_GUARD_MESSAGE = exports.isRuntimeAgentType = exports.RUNTIME_AGENT_TYPES = exports.DEFAULT_SANDBOX_IMAGE = void 0;
+exports.OPENCODE_HOST_GUARD_MESSAGE = exports.ANTIGRAVITY_HOST_GUARD_MESSAGE = exports.isRuntimeAgentType = exports.RUNTIME_AGENT_TYPES = exports.GIT_GRANT_CAPABILITY = exports.DEFAULT_SANDBOX_IMAGE = void 0;
 exports.unknownAgentId = unknownAgentId;
 exports.unknownRuntimeIds = unknownRuntimeIds;
 exports.opencodeBlockedOnHost = opencodeBlockedOnHost;
@@ -15,6 +15,8 @@ const agent_types_cjs_1 = require("./agent-types.cjs");
 const sandbox_profile_cjs_1 = require("./sandbox-profile.cjs");
 /** Published image containing git, GitHub CLI, and the pinned Claude Code CLI. */
 exports.DEFAULT_SANDBOX_IMAGE = "ghcr.io/sagentlab/navarch-sandbox-agent:0.1.0";
+// Capability advertised so projects in git proxy mode `required` can dispatch here.
+exports.GIT_GRANT_CAPABILITY = "git_grant_v1";
 var agent_types_cjs_2 = require("./agent-types.cjs");
 Object.defineProperty(exports, "RUNTIME_AGENT_TYPES", { enumerable: true, get: function () { return agent_types_cjs_2.RUNTIME_AGENT_TYPES; } });
 Object.defineProperty(exports, "isRuntimeAgentType", { enumerable: true, get: function () { return agent_types_cjs_2.isRuntimeAgentType; } });
@@ -96,7 +98,9 @@ function loadRuntimeConfig(env = process.env) {
     // default. Docker isolation is an explicit operator opt-in, not a
     // prerequisite for claiming ordinary shell work.
     const sandboxMode = env.NAVARCH_SANDBOX_MODE === "docker" ? "docker" : "host";
-    const defaultCapabilities = sandboxMode === "docker" ? ["docker-sandbox", "shell"] : ["shell", "browser-use"];
+    const defaultCapabilities = sandboxMode === "docker"
+        ? ["docker-sandbox", "shell", exports.GIT_GRANT_CAPABILITY]
+        : ["shell", "browser-use", exports.GIT_GRANT_CAPABILITY];
     const requestedAgentType = (0, agent_types_cjs_1.isRuntimeAgentType)(env.NAVARCH_AGENT) ? env.NAVARCH_AGENT : "claude-code";
     // Multiple sessions share one machine; keeping each agent inside its own
     // worktree is the safe default, so disabling is the explicit opt-out.

package/dist/git-grant.cjs

@@ -0,0 +1,128 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitGrantRefresher = exports.GIT_GRANT_HELPER_FILENAME = exports.GIT_GRANT_FILENAME = exports.GIT_GRANT_DIRNAME = exports.GIT_GRANT_RETRY_MS = exports.GIT_GRANT_REFRESH_MS = void 0;
+exports.gitGrantPaths = gitGrantPaths;
+exports.isGitProxyDisabled = isGitProxyDisabled;
+exports.writePrivateFile = writePrivateFile;
+exports.renderGhHostsYml = renderGhHostsYml;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+exports.GIT_GRANT_REFRESH_MS = 5 * 60 * 1000;
+exports.GIT_GRANT_RETRY_MS = 60 * 1000;
+exports.GIT_GRANT_DIRNAME = ".navarch";
+exports.GIT_GRANT_FILENAME = "git-grant";
+exports.GIT_GRANT_HELPER_FILENAME = "git-credential-navarch-grant.cjs";
+function gitGrantPaths(workDir) {
+    const dir = node_path_1.default.join(workDir, exports.GIT_GRANT_DIRNAME);
+    return { dir, file: node_path_1.default.join(dir, exports.GIT_GRANT_FILENAME) };
+}
+/** True when the broker refused because the project is in mode `off`. */
+function isGitProxyDisabled(error) {
+    const failure = error;
+    if (failure?.status !== 409)
+        return false;
+    const body = failure.body;
+    return body?.code === "git_proxy_disabled";
+}
+/** Writes `content` to `file` with mode 0600 via a same-directory rename, so readers never see a partial value. */
+async function writePrivateFile(file, content) {
+    const tmp = `${file}.${process.pid}.tmp`;
+    await promises_1.default.writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+    await promises_1.default.chmod(tmp, 0o600);
+    await promises_1.default.rename(tmp, file);
+}
+/** gh `hosts.yml` for the proxy host. gh sends `oauth_token` as the Bearer credential. */
+function renderGhHostsYml(proxyHost, grant) {
+    return `${proxyHost}:\n    oauth_token: ${grant}\n    user: navarch\n    git_protocol: https\n`;
+}
+/**
+ * Owns the grant file for one session. `refresh()` fetches and writes a grant;
+ * `start()` does the first refresh (throwing on failure) and then schedules
+ * refreshes every 5 minutes, or every 60 seconds after a failure.
+ */
+class GitGrantRefresher {
+    options;
+    timer = null;
+    stopped = false;
+    inflight = null;
+    issued = null;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+    }
+    get current() {
+        return this.issued;
+    }
+    async refresh() {
+        const issue = await this.options.api.issueGitGrant(this.options.leaseId);
+        if (this.stopped)
+            throw new Error("git grant refresher stopped");
+        // Register before writing so a redaction pass never misses a live value.
+        this.options.registry.register(issue.grant);
+        const expiresAt = Date.parse(issue.expires_at);
+        if (!Number.isFinite(expiresAt) || expiresAt <= this.now()) {
+            throw new Error("git grant is already expired; not writing it");
+        }
+        if (/[\r\n\0]/.test(issue.grant)) {
+            throw new Error("git grant contains unsupported control characters");
+        }
+        await promises_1.default.mkdir(this.options.grantDir, { recursive: true, mode: 0o700 });
+        await promises_1.default.mkdir(this.options.ghConfigDir, { recursive: true, mode: 0o700 });
+        await writePrivateFile(this.options.grantFile, `${issue.grant}\n`);
+        await writePrivateFile(node_path_1.default.join(this.options.ghConfigDir, "hosts.yml"), renderGhHostsYml(issue.proxy_host, issue.grant));
+        this.issued = issue;
+        return issue;
+    }
+    /** First refresh must succeed; later failures are logged and retried. */
+    async start() {
+        const issue = await this.refresh();
+        this.schedule(this.options.refreshMs ?? exports.GIT_GRANT_REFRESH_MS);
+        return issue;
+    }
+    /** Stops, waits for an in-flight refresh, then removes the grant files. */
+    async stopAndClean() {
+        this.stop();
+        await this.inflight?.catch(() => undefined);
+        await this.removeFiles();
+    }
+    async removeFiles() {
+        await promises_1.default.rm(this.options.grantDir, { recursive: true, force: true }).catch(() => undefined);
+        await promises_1.default.rm(node_path_1.default.join(this.options.ghConfigDir, "hosts.yml"), { force: true }).catch(() => undefined);
+    }
+    stop() {
+        this.stopped = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+    }
+    schedule(delayMs) {
+        if (this.stopped)
+            return;
+        this.timer = setTimeout(() => {
+            this.inflight = this.tick();
+        }, delayMs);
+        this.timer.unref?.();
+    }
+    async tick() {
+        if (this.stopped)
+            return;
+        try {
+            await this.refresh();
+            this.schedule(this.options.refreshMs ?? exports.GIT_GRANT_REFRESH_MS);
+        }
+        catch (error) {
+            // Never leave an expired grant for the agent to use: remove it.
+            const expiresAt = this.issued ? Date.parse(this.issued.expires_at) : 0;
+            if (expiresAt <= this.now()) {
+                await this.removeFiles();
+            }
+            this.options.log.warn(`git grant refresh failed for ${this.options.leaseId}; retrying in ${(this.options.retryMs ?? exports.GIT_GRANT_RETRY_MS) / 1000}s: ${String(error)}`);
+            this.schedule(this.options.retryMs ?? exports.GIT_GRANT_RETRY_MS);
+        }
+    }
+}
+exports.GitGrantRefresher = GitGrantRefresher;

package/dist/git-worktree.cjs

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitWorktree = void 0;
+exports.proxyCloneUrl = proxyCloneUrl;
 exports.branchSlug = branchSlug;
 exports.hostedCheckpointRef = hostedCheckpointRef;
 const node_path_1 = __importDefault(require("node:path"));
@@ -11,6 +12,12 @@ const worktree_janitor_cjs_1 = require("./worktree-janitor.cjs");
 const node_fs_1 = require("node:fs");
 const sandbox_cjs_1 = require("./sandbox.cjs");
 const repositoryLocks = new Map();
+/** Rewrites a github.com HTTPS clone URL onto the proxy; other URLs are returned unchanged. */
+function proxyCloneUrl(cloneUrl, proxyBaseUrl) {
+    const base = proxyBaseUrl.replace(/\/+$/, "");
+    const match = /^https:\/\/github\.com\/(.+)$/i.exec(cloneUrl);
+    return match ? `${base}/${match[1]}` : cloneUrl;
+}
 /**
  * A freshly minted installation token can be rejected for a second or two
  * before GitHub propagates it, and git reports that 404 on a private repo as
@@ -40,6 +47,7 @@ class GitWorktree {
     checkpointRoot;
     cloneUrl;
     githubToken;
+    gitGrant;
     workingBranch;
     repoLocalGithubToken;
     prContinuation;
@@ -77,8 +85,11 @@ class GitWorktree {
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.authRetryDelaysMs = options.authRetryDelaysMs ?? DEFAULT_AUTH_RETRY_DELAYS_MS;
         this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-        this.cloneUrl = options.cloneUrl;
-        this.githubToken = options.githubToken;
+        this.gitGrant = options.gitGrant;
+        this.cloneUrl = options.gitGrant
+            ? proxyCloneUrl(options.cloneUrl, options.gitGrant.proxyBaseUrl)
+            : options.cloneUrl;
+        this.githubToken = options.gitGrant ? undefined : options.githubToken;
         this.workingBranch = options.workingBranch?.trim() || null;
         this.repoLocalGithubToken = options.repoLocalGithubToken;
         this.prContinuation = options.prContinuation ?? false;
@@ -181,7 +192,7 @@ class GitWorktree {
             }
             catch (error) {
                 const delay = this.authRetryDelaysMs[attempt];
-                if (!this.githubToken || delay === undefined || !TRANSIENT_GIT_AUTH_FAILURE.test(errorMessage(error))) {
+                if ((!this.githubToken && !this.gitGrant) || delay === undefined || !TRANSIENT_GIT_AUTH_FAILURE.test(errorMessage(error))) {
                     throw error;
                 }
                 await this.sleep(delay);
@@ -684,6 +695,15 @@ class GitWorktree {
         }
     }
     async runGit(args, authenticated) {
+        if (authenticated && this.gitGrant) {
+            // The helper reads the grant file the runtime refreshes; no token enters
+            // argv or the environment.
+            const grantResult = await this.runner.run("git", ["-c", "credential.helper=", "-c", `credential.helper=${this.gitGrant.credentialHelper}`, ...args], { env: gitEnvWithoutGithubTokens() });
+            if (grantResult.code !== 0) {
+                throw new Error(`git ${args[0] ?? "command"} failed: ${grantResult.stderr || grantResult.stdout}`);
+            }
+            return grantResult;
+        }
         const credentialArgs = authenticated && this.githubToken
             ? [
                 "-c",
@@ -704,6 +724,13 @@ class GitWorktree {
     }
 }
 exports.GitWorktree = GitWorktree;
+/** Parent env for grant-mode git: prompts off and no inherited GitHub token. */
+function gitEnvWithoutGithubTokens() {
+    const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+    delete env.GITHUB_TOKEN;
+    delete env.GH_TOKEN;
+    return env;
+}
 function repoLocalGithubTokenBlock(marker, token) {
     const escaped = token
         .replace(/\\/g, "\\\\")

package/dist/github-credential.cjs

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_CREDENTIAL_SECRET_NAME = void 0;
+exports.githubCredentialDenialSummary = githubCredentialDenialSummary;
+/** Wire name the session requests its repository credential under. */
+exports.GITHUB_CREDENTIAL_SECRET_NAME = "github-pat";
+/**
+ * Denials that mean no repository credential exists for this lease, rather
+ * than one being refused: the project has neither a GitHub App installation
+ * nor a `github-pat` secret (`not_found`), or a standalone PR review on a
+ * PAT-connected project, which deliberately gets none
+ * (`standalone_review_read_only`). The machine's own git login has always
+ * been the clone credential then, so those sessions keep running.
+ */
+const NO_CREDENTIAL_REASONS = new Set(["not_found", "standalone_review_read_only"]);
+const MEMBER_FIX = "or have a project owner move this agent to the project GitHub identity, then resume the agent on the Agents page.";
+const REASON_TEXT = {
+    member_github_missing: `this agent acts as a project member whose GitHub account is not connected. Connect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_github_revoked: `this agent acts as a project member whose GitHub authorization was revoked. Reconnect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_github_unavailable: `this agent acts as a project member whose GitHub credential could not be read. Reconnect GitHub on that member's Account page, ${MEMBER_FIX}`,
+    member_not_in_project: `this agent acts as a member who does not belong to this project. Add them to the project, ${MEMBER_FIX}`,
+};
+/**
+ * The failure summary for a lease whose repository credential the broker
+ * refused, or null when the session may proceed.
+ *
+ * Without this check a refused credential left the clone to whatever git
+ * credential helper the host had configured — on pebble-agent-1721
+ * (2026-10-21) that was `gh auth git-credential` for an account that cannot
+ * see the repository, so every claim failed with an unexplained "Repository
+ * not found". The summary leads with `GitHub credential denied (<reason>):`,
+ * which the control plane's failure attribution anchors on to pause the
+ * machine instead of spending the task's retries
+ * (lib/navarch/failure-attribution.ts MEMBER_GITHUB_RULE).
+ */
+function githubCredentialDenialSummary(denied) {
+    const denial = denied?.find((entry) => entry.name === exports.GITHUB_CREDENTIAL_SECRET_NAME);
+    if (!denial || NO_CREDENTIAL_REASONS.has(denial.reason))
+        return null;
+    const explanation = REASON_TEXT[denial.reason] ?? "the control plane refused the repository credential for this lease.";
+    return (`GitHub credential denied (${denial.reason}): ${explanation} ` +
+        "The session stopped before cloning instead of falling back to this machine's own git login.");
+}

package/dist/github-pr.cjs

@@ -63,7 +63,8 @@ async function findHeadBranchPullRequestUrl(options) {
     if (!owner || !name || extra.length > 0) {
         throw new Error(`Invalid GitHub repository name: ${options.repository}`);
     }
-    const branchUrl = new URL(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls`);
+    const apiBase = (options.apiBaseUrl ?? "https://api.github.com").replace(/\/+$/, "");
+    const branchUrl = new URL(`${apiBase}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls`);
     branchUrl.searchParams.set("state", "all");
     branchUrl.searchParams.set("head", `${owner}:${options.headBranch}`);
     branchUrl.searchParams.set("per_page", "10");
@@ -87,7 +88,7 @@ async function findHeadBranchPullRequestUrl(options) {
                 candidate.head.sha.toLowerCase() === normalizedHeadSha)));
     if (branchMatch || !normalizedHeadSha || options.allowShaFallback === false)
         return branchMatch;
-    const commitUrl = new URL(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/commits/${normalizedHeadSha}/pulls`);
+    const commitUrl = new URL(`${apiBase}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/commits/${normalizedHeadSha}/pulls`);
     commitUrl.searchParams.set("per_page", "10");
     return matchingPullRequestUrl(
     // GitHub answers 422 ("No commit found for SHA") when the local head was

package/dist/sandbox-profile.cjs

@@ -76,7 +76,7 @@ const PROFILES = {
         capDrop: ["ALL"],
         securityOpt: ["no-new-privileges"],
         network: { mode: "open", allow: [] },
-        mounts: { allow: ["workspace", "shared-git"], readOnly: [] },
+        mounts: { allow: ["workspace", "shared-git", "git-grant"], readOnly: ["git-grant"] },
         secrets: BASE_SECRETS,
     },
     // Tightest posture: non-root, capped, GitHub-only egress that fails closed,
@@ -92,7 +92,7 @@ const PROFILES = {
         capDrop: ["ALL"],
         securityOpt: ["no-new-privileges"],
         network: { mode: "allowlist", allow: exports.GITHUB_EGRESS_ALLOWLIST },
-        mounts: { allow: ["workspace", "shared-git"], readOnly: ["shared-git"] },
+        mounts: { allow: ["workspace", "shared-git", "git-grant"], readOnly: ["shared-git", "git-grant"] },
         secrets: BASE_SECRETS,
     },
     // Verification workloads (build + full test suite) need real resources and
@@ -110,7 +110,7 @@ const PROFILES = {
             mode: "allowlist",
             allow: [...exports.GITHUB_EGRESS_ALLOWLIST, ...PACKAGE_REGISTRY_ALLOWLIST],
         },
-        mounts: { allow: ["workspace", "shared-git"], readOnly: [] },
+        mounts: { allow: ["workspace", "shared-git", "git-grant"], readOnly: ["git-grant"] },
         secrets: BASE_SECRETS,
     },
 };

package/dist/sandbox.cjs

@@ -120,6 +120,7 @@ class DockerSandbox {
     workDir;
     containerWorkDir;
     sharedGitDir;
+    gitGrantDir;
     appliedFlags = [];
     denials = [];
     constructor(opts) {
@@ -130,6 +131,7 @@ class DockerSandbox {
         this.image = opts.image;
         this.containerWorkDir = opts.containerWorkDir ?? null;
         this.sharedGitDir = opts.sharedGitDir ?? null;
+        this.gitGrantDir = opts.gitGrantDir ?? null;
         this.profile = opts.profile ?? (0, sandbox_profile_cjs_1.resolveSandboxProfile)(sandbox_profile_cjs_1.DEFAULT_SANDBOX_PROFILE_ID);
     }
     /**
@@ -166,6 +168,16 @@ class DockerSandbox {
                 allowedRoot: sessionsRoot,
             },
         ];
+        if (this.gitGrantDir) {
+            // Read-only overlay: the runtime parent rewrites the file on the host;
+            // nothing in the container can change or delete it.
+            requests.push({
+                kind: "git-grant",
+                hostPath: this.gitGrantDir,
+                containerPath: this.gitGrantDir,
+                allowedRoot: sessionsRoot,
+            });
+        }
         if (this.sharedGitDir) {
             requests.push({
                 kind: "shared-git",

package/dist/session.cjs

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runSession = runSession;
+exports.gitGrantCredentialHelper = gitGrantCredentialHelper;
 exports.toEnvMap = toEnvMap;
 const muse_cjs_1 = require("./adapters/muse.cjs");
 const node_path_1 = __importDefault(require("node:path"));
@@ -34,10 +35,13 @@ const completion_retry_cjs_1 = require("./completion-retry.cjs");
 const adapter_capacity_cjs_1 = require("./adapter-capacity.cjs");
 const agent_auth_cjs_1 = require("./agent-auth.cjs");
 const agent_model_cjs_1 = require("./agent-model.cjs");
+const github_credential_cjs_1 = require("./github-credential.cjs");
 const browser_evidence_cjs_1 = require("./browser-evidence.cjs");
+const git_grant_cjs_1 = require("./git-grant.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
 const GIT_CREDENTIAL_HELPER_FILENAME = "git-credential-navarch.cjs";
+const GIT_GRANT_HELPER_FILENAME = "git-credential-navarch-grant.cjs";
 const COMPLETION_REMEDIATION_RETRIES = 2;
 /**
  * Turns the delivery gate (delivery.cjs) may spend on a session that finished
@@ -158,15 +162,82 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     registry.register(api.getToken());
     let secrets = {};
     let managedGithubCredential = false;
-    const secretNames = bundle.secret_manifest.map((s) => s.name);
+    // Git grant (CX-3.7). The bundle may carry the project's git proxy mode;
+    // otherwise the grant endpoint decides (409 git_proxy_disabled = mode off).
+    // The runtime parent fetches and refreshes the grant; the agent never sees
+    // the machine token or a GitHub token in these modes.
+    const bundleGitMode = bundle.repository?.git_proxy_mode;
+    let gitGrantRefresher;
+    let gitGrantEnv;
+    if (bundleGitMode !== "off") {
+        const grantPaths = (0, git_grant_cjs_1.gitGrantPaths)(workDir);
+        const refresher = new git_grant_cjs_1.GitGrantRefresher({
+            api,
+            leaseId,
+            grantDir: grantPaths.dir,
+            grantFile: grantPaths.file,
+            ghConfigDir: (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir),
+            registry,
+            log,
+        });
+        try {
+            const issue = await refresher.start();
+            const helperPath = node_path_1.default.join(workDir, GIT_GRANT_HELPER_FILENAME);
+            await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch-grant.cjs"), helperPath);
+            gitGrantRefresher = refresher;
+            gitGrantEnv = {
+                proxyHost: issue.proxy_host,
+                proxyBaseUrl: issue.proxy_base_url,
+                grantFile: grantPaths.file,
+                helperPath,
+            };
+        }
+        catch (error) {
+            await refresher.stopAndClean();
+            if (bundleGitMode !== undefined)
+                throw error;
+            // Mode unknown: only an explicit 409 git_proxy_disabled (mode off) or a
+            // 404 (control plane without the endpoint) selects the legacy path.
+            // Any other failure must not fall back, because the legacy path would put
+            // the raw token and machine token in the agent env of an optional or
+            // required project.
+            const noEndpoint = error instanceof api_cjs_1.NavarchApiError && error.status === 404;
+            if (!(0, git_grant_cjs_1.isGitProxyDisabled)(error) && !noEndpoint)
+                throw error;
+        }
+    }
+    const gitGrantMode = gitGrantEnv !== undefined;
+    const githubSecretNames = new Set(["github-pat", bundle.repository?.credential_secret_name ?? "github-pat"]);
+    const secretNames = bundle.secret_manifest
+        .map((s) => s.name)
+        .filter((name) => !(gitGrantMode && githubSecretNames.has(name)));
     if (secretNames.length > 0) {
         const issued = await api.issueSecrets({ lease_id: leaseId, secret_names: secretNames });
         secrets = issued.secrets;
         managedGithubCredential = issued.github_app_issued === true;
         registry.registerAll(secrets);
+        const credentialDenial = (0, github_credential_cjs_1.githubCredentialDenialSummary)(issued.denied);
+        if (credentialDenial) {
+            log.error(`session ${leaseId}: ${credentialDenial}`);
+            await api.completeLease(leaseId, {
+                status: "failed",
+                report: credentialDenial,
+                failure_summary: credentialDenial,
+                failed_before_start: true,
+                evidence_urls: [],
+                cost: { tokens_in: 0, tokens_out: 0, cost_usd: 0 },
+                exit_status: "crashed",
+                agent_type: runtime,
+                ...executionReport,
+            });
+            secrets = {};
+            await gitGrantRefresher?.stopAndClean();
+            await node_fs_1.promises.rm(workDir, { recursive: true, force: true }).catch(() => undefined);
+            return;
+        }
     }
     let gitCredentialRefresh;
-    if (managedGithubCredential && secrets["github-pat"]) {
+    if (!gitGrantMode && managedGithubCredential && secrets["github-pat"]) {
         const helperPath = node_path_1.default.join(workDir, GIT_CREDENTIAL_HELPER_FILENAME);
         await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch.cjs"), helperPath);
         gitCredentialRefresh = {
@@ -176,10 +247,16 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             leaseId,
         };
     }
-    const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail);
+    const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail, gitGrantEnv);
     const ghConfigDir = (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir);
     await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
     sessionEnv.GH_CONFIG_DIR = ghConfigDir;
+    if (gitGrantMode) {
+        // Adapters spread process.env under this map. Blank any GitHub token the
+        // runtime process itself holds so the agent cannot inherit it.
+        sessionEnv.GITHUB_TOKEN = "";
+        sessionEnv.GH_TOKEN = "";
+    }
     const cloneUrl = bundle.repository?.clone_url ??
         (task.repo ? `https://github.com/${task.repo.replace(/\.git$/, "")}.git` : null);
     if (!cloneUrl) {
@@ -196,10 +273,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             ...executionReport,
         });
         secrets = {};
+        await gitGrantRefresher?.stopAndClean();
         await node_fs_1.promises.rm(workDir, { recursive: true, force: true }).catch(() => undefined);
         return;
     }
-    const githubToken = secrets[bundle.repository?.credential_secret_name ?? "github-pat"];
+    const githubToken = gitGrantMode ? undefined : secrets[bundle.repository?.credential_secret_name ?? "github-pat"];
     // A root task owns one delivery branch, so the pre-push guard and the
     // completion-time reconciliation keep the agent on the allocated
     // `navarch/...` branch. PR-continuation tasks are the exception: their agent
@@ -216,7 +294,15 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         cloneUrl,
         githubToken,
         workingBranch: bundle.repository?.working_branch,
-        repoLocalGithubToken: secrets["github-pat"],
+        // Grant modes never expose a GitHub token, so the Codex repo-local
+        // github-pat bootstrap is not installed.
+        repoLocalGithubToken: gitGrantMode ? undefined : secrets["github-pat"],
+        gitGrant: gitGrantEnv
+            ? {
+                proxyBaseUrl: gitGrantEnv.proxyBaseUrl,
+                credentialHelper: gitGrantCredentialHelper(gitGrantEnv),
+            }
+            : undefined,
         // Hosted runs skip checkpoints for verify tasks, which deliver a verdict.
         restoreHostedCheckpoint: !allowBranchRename && task.task_type !== "verify",
     });
@@ -340,6 +426,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             image: config.dockerImage,
             containerWorkDir: gitWorktree.worktreePath,
             sharedGitDir: gitWorktree.repositoryPath,
+            gitGrantDir: gitGrantMode ? (0, git_grant_cjs_1.gitGrantPaths)(workDir).dir : undefined,
             profile: (0, sandbox_profile_cjs_1.resolveSandboxProfile)(config.sandboxProfile, {
                 egressNetwork: config.sandboxEgressNetwork,
             }),
@@ -832,7 +919,10 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                     // Keep SHA verification on the exact branch, but do not adopt a
                     // foreign-branch PR as delivery evidence for a root task.
                     allowShaFallback: allowBranchRename,
-                    githubToken,
+                    githubToken: gitGrantMode ? gitGrantRefresher?.current?.grant : githubToken,
+                    // Grant modes read through the proxy and never use the host's own gh login.
+                    apiBaseUrl: gitGrantEnv ? `${gitGrantEnv.proxyBaseUrl.replace(/\/+$/, "")}/api/v3` : undefined,
+                    hostTokenProvider: gitGrantMode ? async () => undefined : undefined,
                 });
                 if (pullRequestUrl)
                     mapping.evidenceUrls.push(pullRequestUrl);
@@ -1083,6 +1173,9 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         // request. A later heartbeat response sees sessionClosing and does nothing.
         await Promise.resolve(heartbeatWorkspaceUpdate).catch(() => undefined);
         secrets = {};
+        // Waits for an in-flight refresh, then removes the grant files so none
+        // survives in a retained workspace.
+        await gitGrantRefresher?.stopAndClean();
         // A sandbox teardown failure must not skip worktree cleanup: a leftover
         // task branch in the shared cache blocks the task's next retry.
         try {
@@ -1271,8 +1364,14 @@ function isAlreadyReleasedCompletionError(err) {
     const body = err.body;
     return body.code === "already_released" || body.error === "lease already released";
 }
+/** The `credential.helper` value that prints the grant from its file. */
+function gitGrantCredentialHelper(config) {
+    return `!node ${shellQuote(config.helperPath)} ${shellQuote(config.grantFile)}`;
+}
+/** Secret names (lowercased, non-alphanumerics as `_`) that are raw GitHub credentials. */
+const GITHUB_CREDENTIAL_SECRETS = new Set(["github_pat", "github_token", "gh_token"]);
 /** Uppercases + sanitizes secret names into shell-safe env var names for injectEnv(). */
-function toEnvMap(secrets, credentialRefreshOrAuthorName, gitAuthorNameOrEmail = "sagentlab", gitAuthorEmail = "z@sagentlab.com") {
+function toEnvMap(secrets, credentialRefreshOrAuthorName, gitAuthorNameOrEmail = "sagentlab", gitAuthorEmail = "z@sagentlab.com", gitGrant) {
     // Keep the existing `(secrets, authorName, authorEmail)` call shape while
     // accepting a refresh config before the author identity for managed repos.
     const gitCredentialRefresh = typeof credentialRefreshOrAuthorName === "string"
@@ -1286,8 +1385,31 @@ function toEnvMap(secrets, credentialRefreshOrAuthorName, gitAuthorNameOrEmail =
         : gitAuthorEmail;
     const out = {};
     for (const [name, value] of Object.entries(secrets)) {
+        if (gitGrant && GITHUB_CREDENTIAL_SECRETS.has(name.toLowerCase().replace(/[^a-z0-9]/g, "_")))
+            continue;
         out[name.toUpperCase().replace(/[^A-Z0-9_]/g, "_")] = value;
     }
+    if (gitGrant) {
+        // Grant modes: git and gh authenticate with the grant file. No machine
+        // token, lease id, GitHub token or github-pat value reaches the agent.
+        const proxyBase = gitGrant.proxyBaseUrl.replace(/\/+$/, "");
+        const grantConfig = [
+            ["user.name", gitAuthorName],
+            ["user.email", resolvedGitAuthorEmail],
+            [`url.${proxyBase}/.insteadOf`, "https://github.com/"],
+            [`url.${proxyBase}/.insteadOf`, "git@github.com:"],
+            [`credential.${proxyBase}.helper`, ""],
+            [`credential.${proxyBase}.helper`, gitGrantCredentialHelper(gitGrant)],
+        ];
+        out.GIT_TERMINAL_PROMPT = "0";
+        out.GH_HOST = gitGrant.proxyHost;
+        out.GIT_CONFIG_COUNT = String(grantConfig.length);
+        grantConfig.forEach(([key, value], index) => {
+            out[`GIT_CONFIG_KEY_${index}`] = key;
+            out[`GIT_CONFIG_VALUE_${index}`] = value;
+        });
+        return out;
+    }
     const gitConfig = [
         ["user.name", gitAuthorName],
         ["user.email", resolvedGitAuthorEmail],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.126",
+  "version": "0.1.128",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",