@sagentlab/navarch-runtime 0.1.129 → 0.1.130

package/README.md

@@ -476,7 +476,7 @@ unchanged across the deployment.
 | `NAVARCH_OPENCODE_STARTUP_TIMEOUT_MS` | `120000` (2 min) | Stop OpenCode when it produces no stdout/stderr during startup. This catches provider auth/quota failures that leave its CLI process alive. `0` disables the startup deadline. |
 | `NAVARCH_WORKTREE_CLEANUP_INTERVAL_MS` | `3600000` (1 hour) | How often the runtime scans for session worktrees abandoned by a hard exit or host restart. |
 | `NAVARCH_WORKTREE_STALE_AFTER_MS` | `86400000` (24 hours) | Minimum inactivity age before an abandoned session worktree is removed. Active sessions are always protected. |
-| `NAVARCH_GIT_AUTHOR_NAME` / `NAVARCH_GIT_AUTHOR_EMAIL` | `sagentlab` / `z@sagentlab.com` | Git identity forced into session commits so host-level personal config is not inherited; override both for a project-authorized bot. |
+| `NAVARCH_GIT_AUTHOR_NAME` / `NAVARCH_GIT_AUTHOR_EMAIL` | `sagentlab` / `z@sagentlab.com` | Git identity forced into session commits so host-level personal config is not inherited; override both for a project-authorized bot. For a project whose git proxy mode is not `off`, the control plane's commit identity (the GitHub App bot, or the consenting requester per the project's `git_attribution_mode`) replaces it, and a shared `prepare-commit-msg` hook adds `Navarch-Task` and any `Co-authored-by` trailer once. |
 | `NAVARCH_SANDBOX_MODE` | `host` | `host` uses the resources already available to the agent process. Set `docker` explicitly for container isolation. |
 | `NAVARCH_SANDBOX_PROFILE` | `trusted-development` | Named security profile for Docker sessions (`src/sandbox-profile.cts`): `trusted-development` (image-default user, uncapped, open egress), `untrusted-code` (non-root, 2 CPU / 4g / 512 PIDs, deny-by-default egress, read-only shared git), `elevated-verification` (non-root, 4 CPU / 8g / 2048 PIDs, egress limited to GitHub plus package registries). The default is the exact pre-profile flag set. |
 | `NAVARCH_SANDBOX_EGRESS_NETWORK` | _(unset)_ | Docker network that enforces a profile's egress allowlist. Docker cannot filter by domain itself, so an allowlist profile without this fails closed to `--network=none` and records the denial. |

package/dist/commit-attribution.cjs

@@ -0,0 +1,124 @@
+"use strict";
+// Commit attribution for proxied sessions (CX-3.7, issue #1546 "design 4/5").
+//
+// For a project whose git proxy mode is not `off`, the control plane resolves
+// who the session's commits name and sends it as `repository.commit_identity`
+// in the claim bundle (the git grant's `actor`/`attribution` claims carry the
+// same identity). The runtime sets git's author and committer from it, and the
+// shared `prepare-commit-msg` hook appends its trailers once per commit.
+//
+// Mirrors lib/navarch/commit-attribution.ts in the control plane, which this
+// standalone package cannot import. Keep PREPARE_COMMIT_MSG_HOOK in sync; a
+// root test compares the two.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PREPARE_COMMIT_MSG_HOOK = exports.COMMIT_TRAILER_CONFIG_KEY = void 0;
+exports.parseCommitIdentity = parseCommitIdentity;
+exports.commitIdentityGitConfig = commitIdentityGitConfig;
+exports.applyCommitIdentityEnv = applyCommitIdentityEnv;
+exports.installCommitTrailerHook = installCommitTrailerHook;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+/** Git config key the hook reads; multi-valued, one trailer per value. */
+exports.COMMIT_TRAILER_CONFIG_KEY = "navarch.commitTrailer";
+const MODES = ["bot", "human_coauthor", "human_author"];
+const SAFE_VALUE = /^[^\r\n\0]{1,256}$/;
+function parseIdentity(candidate) {
+    const c = candidate;
+    if (!c || typeof c.name !== "string" || typeof c.email !== "string")
+        return null;
+    if (!SAFE_VALUE.test(c.name) || !SAFE_VALUE.test(c.email) || /[<>]/.test(c.name) || /[<>\s]/.test(c.email))
+        return null;
+    return { name: c.name, email: c.email };
+}
+/** Validates the claim bundle's `commit_identity`. Null when absent or malformed (keep the configured identity). */
+function parseCommitIdentity(value) {
+    const v = value;
+    if (!v || typeof v !== "object" || !MODES.includes(v.mode))
+        return null;
+    const author = parseIdentity(v.author);
+    const committer = parseIdentity(v.committer);
+    if (!author || !committer || !Array.isArray(v.trailers) || v.trailers.length > 8)
+        return null;
+    const trailers = [];
+    for (const trailer of v.trailers) {
+        if (typeof trailer !== "string" || !SAFE_VALUE.test(trailer) || !/^[A-Za-z0-9-]+: \S/.test(trailer))
+            return null;
+        trailers.push(trailer);
+    }
+    return { mode: v.mode, author, committer, trailers };
+}
+/** Git config entries for the identity: user.*, author.*, committer.* and the trailers. */
+function commitIdentityGitConfig(identity) {
+    return [
+        ["user.name", identity.author.name],
+        ["user.email", identity.author.email],
+        ["author.name", identity.author.name],
+        ["author.email", identity.author.email],
+        ["committer.name", identity.committer.name],
+        ["committer.email", identity.committer.email],
+        ...identity.trailers.map((trailer) => [exports.COMMIT_TRAILER_CONFIG_KEY, trailer]),
+    ];
+}
+/**
+ * Appends git config entries to an env map that already uses
+ * `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/`GIT_CONFIG_VALUE_n` (toEnvMap). Later
+ * entries win for single-valued keys, so this replaces the default
+ * `user.name`/`user.email` (NAVARCH_GIT_AUTHOR_*) for this session only. The
+ * entries are session-scoped: nothing is written to the shared repository cache.
+ */
+function applyCommitIdentityEnv(env, identity) {
+    const parsed = Number.parseInt(env.GIT_CONFIG_COUNT ?? "0", 10);
+    let count = Number.isSafeInteger(parsed) && parsed > 0 ? parsed : 0;
+    for (const [key, value] of commitIdentityGitConfig(identity)) {
+        env[`GIT_CONFIG_KEY_${count}`] = key;
+        env[`GIT_CONFIG_VALUE_${count}`] = value;
+        count += 1;
+    }
+    env.GIT_CONFIG_COUNT = String(count);
+}
+/**
+ * `prepare-commit-msg` hook. Inert unless the session set
+ * `navarch.commitTrailer`. `--if-exists addIfDifferent` makes it idempotent:
+ * an amend, reword or rebase that already carries a trailer does not get it
+ * twice. An empty message stays empty so git still aborts the commit.
+ * Git's own comment lines and the `commit -v` scissors section are set aside
+ * before the trailers are added (see the control-plane copy for details).
+ */
+exports.PREPARE_COMMIT_MSG_HOOK = `#!/bin/sh
+# Managed by Navarch (commit attribution, CX-3.7).
+msg_file="$1"
+source="$2"
+[ -n "$msg_file" ] && [ -f "$msg_file" ] || exit 0
+trailers="$(git config --get-all ${exports.COMMIT_TRAILER_CONFIG_KEY} 2>/dev/null)" || exit 0
+[ -n "$trailers" ] || exit 0
+cc="$(git config core.commentChar 2>/dev/null)"
+[ -n "$cc" ] && [ "$cc" != auto ] || cc='#'
+body="$msg_file.navarch-body"
+rest="$msg_file.navarch-rest"
+trap 'rm -f "$body" "$rest"' EXIT
+: > "$body"
+: > "$rest"
+awk -v cc="$cc" -v src="$source" -v body="$body" -v rest="$rest" '
+  cut { print >> rest; next }
+  index($0, cc " ------------------------ >8 ------------------------") == 1 { cut = 1; print >> rest; next }
+  src != "message" && index($0, cc) == 1 { print >> rest; next }
+  { print >> body }
+' "$msg_file" || exit 1
+grep -q '[^[:space:]]' "$body" || exit 0
+printf '%s\\n' "$trailers" | while IFS= read -r trailer; do
+  [ -n "$trailer" ] || continue
+  git interpret-trailers --in-place --if-exists addIfDifferent --trailer "$trailer" "$body" || exit 1
+done || exit 1
+{ cat "$body"; if [ -s "$rest" ]; then echo; cat "$rest"; fi; } > "$msg_file"
+`;
+/** Writes the hook into a hooks directory (the shared cache's, like the pre-push guard). */
+async function installCommitTrailerHook(hooksDir) {
+    await promises_1.default.mkdir(hooksDir, { recursive: true });
+    await promises_1.default.writeFile(node_path_1.default.join(hooksDir, "prepare-commit-msg"), exports.PREPARE_COMMIT_MSG_HOOK, {
+        encoding: "utf8",
+        mode: 0o755,
+    });
+}

package/dist/git-worktree.cjs

@@ -11,6 +11,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const worktree_janitor_cjs_1 = require("./worktree-janitor.cjs");
 const node_fs_1 = require("node:fs");
 const sandbox_cjs_1 = require("./sandbox.cjs");
+const commit_attribution_cjs_1 = require("./commit-attribution.cjs");
 const repositoryLocks = new Map();
 /** Rewrites a github.com HTTPS clone URL onto the proxy; other URLs are returned unchanged. */
 function proxyCloneUrl(cloneUrl, proxyBaseUrl) {
@@ -51,6 +52,7 @@ class GitWorktree {
     workingBranch;
     repoLocalGithubToken;
     prContinuation;
+    ownershipCommitIdentity;
     taskBranchSuffix;
     legacyTaskBranchSuffix;
     taskOwnershipTrailer;
@@ -93,6 +95,7 @@ class GitWorktree {
         this.workingBranch = options.workingBranch?.trim() || null;
         this.repoLocalGithubToken = options.repoLocalGithubToken;
         this.prContinuation = options.prContinuation ?? false;
+        this.ownershipCommitIdentity = options.ownershipCommitIdentity ?? { name: "Navarch", email: "runtime@navarch.local" };
         this.hostedCheckpointRef = options.restoreHostedCheckpoint ? hostedCheckpointRef(options.taskId) : null;
         this.hostedCheckpointLocalRef = `refs/navarch/restored-checkpoints/${taskKey}`;
     }
@@ -155,6 +158,9 @@ class GitWorktree {
             encoding: "utf8",
             mode: 0o755,
         });
+        // Commit attribution trailers (CX-3.7). Like the guard, the hook is inert
+        // unless the session's own git config sets `navarch.commitTrailer`.
+        await (0, commit_attribution_cjs_1.installCommitTrailerHook)(hooksDir);
     }
     /** Clones the bare cache if missing, repoints origin if needed, and fetches all branches. */
     async ensureRepositoryCache() {
@@ -500,9 +506,9 @@ class GitWorktree {
             "-C",
             this.worktreePath,
             "-c",
-            "user.name=Navarch",
+            `user.name=${this.ownershipCommitIdentity.name}`,
             "-c",
-            "user.email=runtime@navarch.local",
+            `user.email=${this.ownershipCommitIdentity.email}`,
             "commit",
             "--allow-empty",
             "-m",

package/dist/session.cjs

@@ -38,6 +38,7 @@ const agent_model_cjs_1 = require("./agent-model.cjs");
 const github_credential_cjs_1 = require("./github-credential.cjs");
 const browser_evidence_cjs_1 = require("./browser-evidence.cjs");
 const git_grant_cjs_1 = require("./git-grant.cjs");
+const commit_attribution_cjs_1 = require("./commit-attribution.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
 const GIT_CREDENTIAL_HELPER_FILENAME = "git-credential-navarch.cjs";
@@ -248,6 +249,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         };
     }
     const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail, gitGrantEnv);
+    // Proxied projects (CX-3.7): the control-plane identity replaces the
+    // NAVARCH_GIT_AUTHOR_* default for this session; mode `off` sends none.
+    const commitIdentity = (0, commit_attribution_cjs_1.parseCommitIdentity)(bundle.repository?.commit_identity);
+    if (commitIdentity)
+        (0, commit_attribution_cjs_1.applyCommitIdentityEnv)(sessionEnv, commitIdentity);
     const ghConfigDir = (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir);
     await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
     sessionEnv.GH_CONFIG_DIR = ghConfigDir;
@@ -305,6 +311,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             : undefined,
         // Hosted runs skip checkpoints for verify tasks, which deliver a verdict.
         restoreHostedCheckpoint: !allowBranchRename && task.task_type !== "verify",
+        ...(commitIdentity ? { ownershipCommitIdentity: commitIdentity.committer } : {}),
     });
     const knownGuidanceIds = new Set((bundle.guidance ?? []).map((entry) => entry.id));
     const deliveredGuidance = [...(bundle.guidance ?? [])];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.129",
+  "version": "0.1.130",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",