@sagentlab/navarch-runtime 0.1.136 → 0.1.137

package/bin/git-credential-navarch.cjs

@@ -4,19 +4,43 @@
 // for every remote operation, so each lookup gets a fresh installation token
 // from the lease-scoped broker instead of relying on the session-start token.
 
+const fs = require("node:fs");
+
 const operation = process.argv[2];
 if (operation !== "get") process.exit(0);
 
-const apiBase = process.env.NAVARCH_GIT_CREDENTIAL_API_BASE?.replace(/\/+$/, "");
-const machineToken = process.env.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN;
-const leaseId = process.env.NAVARCH_GIT_CREDENTIAL_LEASE_ID;
-
-if (!apiBase || !machineToken || !leaseId) {
-  console.error("navarch git credential helper is missing broker configuration");
-  process.exit(1);
+// Sandboxed sessions (Codex guard) cannot reach the Navarch API, so the
+// runtime parent refreshes the token into this file and the helper only
+// reads it.
+const tokenFile = process.env.NAVARCH_GIT_CREDENTIAL_TOKEN_FILE;
+if (tokenFile) {
+  let token;
+  try {
+    token = fs.readFileSync(tokenFile, "utf8").trim();
+  } catch (error) {
+    console.error(`navarch git credential is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  }
+  if (!token || /[\r\n\0]/.test(token)) {
+    console.error("navarch git credential file is empty or malformed");
+    process.exit(1);
+  }
+  // No process.exit here: on macOS a piped stdout write is asynchronous.
+  process.stdout.write(`username=x-access-token\npassword=${token}\n`);
+} else {
+  void main();
 }
 
 async function main() {
+  const apiBase = process.env.NAVARCH_GIT_CREDENTIAL_API_BASE?.replace(/\/+$/, "");
+  const machineToken = process.env.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN;
+  const leaseId = process.env.NAVARCH_GIT_CREDENTIAL_LEASE_ID;
+
+  if (!apiBase || !machineToken || !leaseId) {
+    console.error("navarch git credential helper is missing broker configuration");
+    process.exit(1);
+  }
+
   try {
     const response = await fetch(`${apiBase}/api/broker/issue`, {
       method: "POST",
@@ -42,5 +66,3 @@ async function main() {
     process.exitCode = 1;
   }
 }
-
-void main();

package/dist/github-credential.cjs

@@ -1,7 +1,13 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GITHUB_CREDENTIAL_SECRET_NAME = void 0;
+exports.GithubTokenFileRefresher = exports.GITHUB_TOKEN_FILENAME = exports.GITHUB_TOKEN_FILE_RETRY_MS = exports.GITHUB_TOKEN_FILE_REFRESH_MS = exports.GITHUB_CREDENTIAL_SECRET_NAME = void 0;
 exports.githubCredentialDenialSummary = githubCredentialDenialSummary;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const git_grant_cjs_1 = require("./git-grant.cjs");
 /** Wire name the session requests its repository credential under. */
 exports.GITHUB_CREDENTIAL_SECRET_NAME = "github-pat";
 /**
@@ -41,3 +47,80 @@ function githubCredentialDenialSummary(denied) {
     return (`GitHub credential denied (${denial.reason}): ${explanation} ` +
         "The session stopped before cloning instead of falling back to this machine's own git login.");
 }
+/** GitHub App installation tokens live an hour; refresh well inside that. */
+exports.GITHUB_TOKEN_FILE_REFRESH_MS = 10 * 60 * 1000;
+exports.GITHUB_TOKEN_FILE_RETRY_MS = 60 * 1000;
+exports.GITHUB_TOKEN_FILENAME = "github-token";
+/**
+ * Keeps a managed repository's installation token in a session file for
+ * agents whose OS sandbox cannot reach the Navarch API (the Codex worktree
+ * guard allows only GitHub hosts). The runtime parent fetches from the broker,
+ * so the machine token never enters the agent environment, and the credential
+ * helper only reads the file. Mirrors GitGrantRefresher.
+ */
+class GithubTokenFileRefresher {
+    options;
+    timer = null;
+    stopped = false;
+    inflight = null;
+    constructor(options) {
+        this.options = options;
+    }
+    /** Writes the session-start token and schedules broker refreshes. */
+    async start(initialToken) {
+        await this.write(initialToken);
+        this.schedule(this.options.refreshMs ?? exports.GITHUB_TOKEN_FILE_REFRESH_MS);
+    }
+    async refresh() {
+        const issued = await this.options.api.issueSecrets({
+            lease_id: this.options.leaseId,
+            secret_names: [exports.GITHUB_CREDENTIAL_SECRET_NAME],
+        });
+        const token = issued.secrets[exports.GITHUB_CREDENTIAL_SECRET_NAME];
+        if (typeof token !== "string" || token.length === 0)
+            throw new Error("broker did not issue github-pat");
+        if (this.stopped)
+            throw new Error("github token refresher stopped");
+        await this.write(token);
+    }
+    /** Stops, waits for an in-flight refresh, then removes the token file. */
+    async stopAndClean() {
+        this.stopped = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        await this.inflight?.catch(() => undefined);
+        await promises_1.default.rm(this.options.tokenFile, { force: true }).catch(() => undefined);
+    }
+    async write(token) {
+        // Register before writing so a redaction pass never misses a live value.
+        this.options.registry.register(token);
+        if (/[\r\n\0]/.test(token))
+            throw new Error("github token contains unsupported control characters");
+        await promises_1.default.mkdir(node_path_1.default.dirname(this.options.tokenFile), { recursive: true, mode: 0o700 });
+        await (0, git_grant_cjs_1.writePrivateFile)(this.options.tokenFile, `${token}\n`);
+    }
+    schedule(delayMs) {
+        if (this.stopped)
+            return;
+        this.timer = setTimeout(() => {
+            this.inflight = this.tick();
+        }, delayMs);
+        this.timer.unref?.();
+    }
+    async tick() {
+        if (this.stopped)
+            return;
+        try {
+            await this.refresh();
+            this.schedule(this.options.refreshMs ?? exports.GITHUB_TOKEN_FILE_REFRESH_MS);
+        }
+        catch (error) {
+            // The previous token stays until its own expiry; GitHub rejects it after.
+            const retryMs = this.options.retryMs ?? exports.GITHUB_TOKEN_FILE_RETRY_MS;
+            this.options.log.warn(`github token refresh failed for ${this.options.leaseId}; retrying in ${retryMs / 1000}s: ${String(error)}`);
+            this.schedule(retryMs);
+        }
+    }
+}
+exports.GithubTokenFileRefresher = GithubTokenFileRefresher;

package/dist/session.cjs

@@ -45,6 +45,7 @@ const commit_attribution_cjs_1 = require("./commit-attribution.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
 const GIT_CREDENTIAL_HELPER_FILENAME = "git-credential-navarch.cjs";
+const SESSION_GIT_GLOBAL_CONFIG_FILENAME = "gitconfig";
 const GIT_GRANT_HELPER_FILENAME = "git-credential-navarch-grant.cjs";
 const COMPLETION_REMEDIATION_RETRIES = 2;
 /**
@@ -185,6 +186,12 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     // The runtime parent fetches and refreshes the grant; the agent never sees
     // the machine token or a GitHub token in these modes.
     const bundleGitMode = bundle.repository?.git_proxy_mode;
+    // Codex's worktree guard is an OS sandbox around the whole agent, git's
+    // credential helper included: it denies the session dir and allows only
+    // GitHub hosts. Helpers and their token files go in a dir it may read.
+    const codexGuarded = config.sandboxMode === "host" && config.worktreeGuard && runtime === "codex";
+    const gitCredentialDir = (0, worktree_guard_cjs_1.sessionGitCredentialDir)(workDir);
+    let githubTokenRefresher;
     let gitGrantRefresher;
     let gitGrantEnv;
     if (bundleGitMode !== "off") {
@@ -200,7 +207,8 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         });
         try {
             const issue = await refresher.start();
-            const helperPath = node_path_1.default.join(workDir, GIT_GRANT_HELPER_FILENAME);
+            await node_fs_1.promises.mkdir(gitCredentialDir, { recursive: true, mode: 0o700 });
+            const helperPath = node_path_1.default.join(gitCredentialDir, GIT_GRANT_HELPER_FILENAME);
             await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch-grant.cjs"), helperPath);
             gitGrantRefresher = refresher;
             gitGrantEnv = {
@@ -256,14 +264,23 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     }
     let gitCredentialRefresh;
     if (!gitGrantMode && managedGithubCredential && secrets["github-pat"]) {
-        const helperPath = node_path_1.default.join(workDir, GIT_CREDENTIAL_HELPER_FILENAME);
+        await node_fs_1.promises.mkdir(gitCredentialDir, { recursive: true, mode: 0o700 });
+        const helperPath = node_path_1.default.join(gitCredentialDir, GIT_CREDENTIAL_HELPER_FILENAME);
         await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch.cjs"), helperPath);
-        gitCredentialRefresh = {
-            helperPath,
-            apiBase: api.getBaseUrl(),
-            machineToken: api.getToken() ?? "",
-            leaseId,
-        };
+        if (codexGuarded) {
+            const tokenFile = node_path_1.default.join(gitCredentialDir, github_credential_cjs_1.GITHUB_TOKEN_FILENAME);
+            githubTokenRefresher = new github_credential_cjs_1.GithubTokenFileRefresher({ api, leaseId, tokenFile, registry, log });
+            await githubTokenRefresher.start(secrets["github-pat"]);
+            gitCredentialRefresh = { helperPath, tokenFile };
+        }
+        else {
+            gitCredentialRefresh = {
+                helperPath,
+                apiBase: api.getBaseUrl(),
+                machineToken: api.getToken() ?? "",
+                leaseId,
+            };
+        }
     }
     const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail, gitGrantEnv);
     // Proxied projects (CX-3.7): the control-plane identity replaces the
@@ -274,6 +291,15 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     const ghConfigDir = (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir);
     await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
     sessionEnv.GH_CONFIG_DIR = ghConfigDir;
+    if (codexGuarded) {
+        // The sandbox cannot read ~/.gitconfig, and git exits on an unreadable
+        // global config, so every agent git command failed until the agent found
+        // GIT_CONFIG_GLOBAL=/dev/null itself. The session file also replaces the
+        // default ~/.config/git/ignore, whose denial warns on every status.
+        await node_fs_1.promises.mkdir(gitCredentialDir, { recursive: true, mode: 0o700 });
+        sessionEnv.GIT_CONFIG_GLOBAL = node_path_1.default.join(gitCredentialDir, SESSION_GIT_GLOBAL_CONFIG_FILENAME);
+        await node_fs_1.promises.writeFile(sessionEnv.GIT_CONFIG_GLOBAL, "[core]\n\texcludesFile = /dev/null\n", { mode: 0o600 });
+    }
     if (gitGrantMode) {
         // Adapters spread process.env under this map. Blank any GitHub token the
         // runtime process itself holds so the agent cannot inherit it.
@@ -297,6 +323,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         });
         secrets = {};
         await gitGrantRefresher?.stopAndClean();
+        await githubTokenRefresher?.stopAndClean();
         await node_fs_1.promises.rm(workDir, { recursive: true, force: true }).catch(() => undefined);
         return;
     }
@@ -730,6 +757,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 workspaceRoot: config.workspaceRoot,
                 extraRoots: config.guardExtraRoots,
                 codexBin: config.codexBin,
+                credentialReadRoots: [
+                    gitCredentialDir,
+                    ...(gitGrantEnv ? [(0, git_grant_cjs_1.gitGrantPaths)(workDir).dir] : []),
+                ],
+                networkHosts: gitGrantEnv ? [gitGrantEnv.proxyHost] : [],
             });
         }
         const restoredCheckpoint = gitWorktree.restoredHostedCheckpoint;
@@ -1424,9 +1456,10 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         // request. A later heartbeat response sees sessionClosing and does nothing.
         await Promise.resolve(heartbeatWorkspaceUpdate).catch(() => undefined);
         secrets = {};
-        // Waits for an in-flight refresh, then removes the grant files so none
-        // survives in a retained workspace.
+        // Waits for an in-flight refresh, then removes the grant and token files
+        // so none survives in a retained workspace.
         await gitGrantRefresher?.stopAndClean();
+        await githubTokenRefresher?.stopAndClean();
         // A sandbox teardown failure must not skip worktree cleanup: a leftover
         // task branch in the shared cache blocks the task's next retry.
         try {
@@ -1668,9 +1701,14 @@ function toEnvMap(secrets, credentialRefreshOrAuthorName, gitAuthorNameOrEmail =
     if (secrets["github-pat"] && !out.GITHUB_TOKEN) {
         out.GITHUB_TOKEN = secrets["github-pat"];
         if (gitCredentialRefresh) {
-            out.NAVARCH_GIT_CREDENTIAL_API_BASE = gitCredentialRefresh.apiBase;
-            out.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN = gitCredentialRefresh.machineToken;
-            out.NAVARCH_GIT_CREDENTIAL_LEASE_ID = gitCredentialRefresh.leaseId;
+            if ("tokenFile" in gitCredentialRefresh) {
+                out.NAVARCH_GIT_CREDENTIAL_TOKEN_FILE = gitCredentialRefresh.tokenFile;
+            }
+            else {
+                out.NAVARCH_GIT_CREDENTIAL_API_BASE = gitCredentialRefresh.apiBase;
+                out.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN = gitCredentialRefresh.machineToken;
+                out.NAVARCH_GIT_CREDENTIAL_LEASE_ID = gitCredentialRefresh.leaseId;
+            }
             gitConfig.unshift(["credential.helper", ""], ["credential.helper", `!node ${shellQuote(gitCredentialRefresh.helperPath)}`]);
             out.GIT_TERMINAL_PROMPT = "0";
         }

package/dist/worktree-guard.cjs

@@ -11,6 +11,7 @@ exports.codexExecutableReadRoots = codexExecutableReadRoots;
 exports.codexHelperReadRoots = codexHelperReadRoots;
 exports.macosDeveloperWriteRoots = macosDeveloperWriteRoots;
 exports.sessionGhConfigDir = sessionGhConfigDir;
+exports.sessionGitCredentialDir = sessionGitCredentialDir;
 exports.sessionCodexTmpDir = sessionCodexTmpDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
@@ -19,6 +20,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const CODEX_GUARD_PROFILE = "navarch-worktree";
 const SESSION_GH_CONFIG_DIRNAME = "gh-config";
+const SESSION_GIT_CREDENTIAL_DIRNAME = "git-credential";
 const CODEX_GITHUB_NETWORK_DOMAINS = {
     "**.github.com": "allow",
     "**.githubusercontent.com": "allow",
@@ -378,6 +380,14 @@ function macosDeveloperWriteRoots(env = process.env, platform = process.platform
 function sessionGhConfigDir(workDir) {
     return node_path_1.default.join(workDir, SESSION_GH_CONFIG_DIRNAME);
 }
+/**
+ * Session-owned directory for git's credential helpers and the token file
+ * they read. It sits beside the session metadata, which the Codex profile
+ * denies, so it is granted read-only by name (credentialReadRoots).
+ */
+function sessionGitCredentialDir(workDir) {
+    return node_path_1.default.join(workDir, SESSION_GIT_CREDENTIAL_DIRNAME);
+}
 function sessionCodexTmpDir(workDir) {
     return node_path_1.default.resolve(workDir, "tmp");
 }
@@ -417,6 +427,16 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
         [sessionGhConfigDir(options.workDir)]: "read",
     };
+    // git runs the credential helper inside the sandbox. Without these grants
+    // the helper copied into the denied session dir looks missing, and every
+    // authenticated fetch or push fails (ShiftSwap, 2026-10-27).
+    // Only strict subdirectories of this session: never the metadata dir itself.
+    const sessionDir = node_path_1.default.resolve(options.workDir);
+    for (const root of options.credentialReadRoots ?? []) {
+        const resolved = node_path_1.default.resolve(root);
+        if (resolved !== sessionDir && isPathInside(resolved, sessionDir))
+            filesystem[resolved] = "read";
+    }
     // Codex protects a linked worktree's gitdir with a more specific read-only
     // rule. A write grant on the bare repository alone does not override it:
     // fetch/checkout/commit fail on FETCH_HEAD, HEAD.lock, or index.lock. Grant
@@ -471,7 +491,10 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
         "-c",
         `permissions.${CODEX_GUARD_PROFILE}.network.enabled=true`,
         "-c",
-        `permissions.${CODEX_GUARD_PROFILE}.network.domains=${tomlInlineTable(CODEX_GITHUB_NETWORK_DOMAINS)}`,
+        `permissions.${CODEX_GUARD_PROFILE}.network.domains=${tomlInlineTable({
+            ...CODEX_GITHUB_NETWORK_DOMAINS,
+            ...Object.fromEntries((options.networkHosts ?? []).map((host) => [host, "allow"])),
+        })}`,
     ];
 }
 function linkedWorktreeGitDir(worktreePath, repositoryPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.136",
+  "version": "0.1.137",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",