@sagentlab/navarch-runtime 0.1.136 → 0.1.138

package/bin/git-credential-navarch.cjs

@@ -4,19 +4,43 @@
 // for every remote operation, so each lookup gets a fresh installation token
 // from the lease-scoped broker instead of relying on the session-start token.
 
+const fs = require("node:fs");
+
 const operation = process.argv[2];
 if (operation !== "get") process.exit(0);
 
-const apiBase = process.env.NAVARCH_GIT_CREDENTIAL_API_BASE?.replace(/\/+$/, "");
-const machineToken = process.env.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN;
-const leaseId = process.env.NAVARCH_GIT_CREDENTIAL_LEASE_ID;
-
-if (!apiBase || !machineToken || !leaseId) {
-  console.error("navarch git credential helper is missing broker configuration");
-  process.exit(1);
+// Sandboxed sessions (Codex guard) cannot reach the Navarch API, so the
+// runtime parent refreshes the token into this file and the helper only
+// reads it.
+const tokenFile = process.env.NAVARCH_GIT_CREDENTIAL_TOKEN_FILE;
+if (tokenFile) {
+  let token;
+  try {
+    token = fs.readFileSync(tokenFile, "utf8").trim();
+  } catch (error) {
+    console.error(`navarch git credential is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  }
+  if (!token || /[\r\n\0]/.test(token)) {
+    console.error("navarch git credential file is empty or malformed");
+    process.exit(1);
+  }
+  // No process.exit here: on macOS a piped stdout write is asynchronous.
+  process.stdout.write(`username=x-access-token\npassword=${token}\n`);
+} else {
+  void main();
 }
 
 async function main() {
+  const apiBase = process.env.NAVARCH_GIT_CREDENTIAL_API_BASE?.replace(/\/+$/, "");
+  const machineToken = process.env.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN;
+  const leaseId = process.env.NAVARCH_GIT_CREDENTIAL_LEASE_ID;
+
+  if (!apiBase || !machineToken || !leaseId) {
+    console.error("navarch git credential helper is missing broker configuration");
+    process.exit(1);
+  }
+
   try {
     const response = await fetch(`${apiBase}/api/broker/issue`, {
       method: "POST",
@@ -42,5 +66,3 @@ async function main() {
     process.exitCode = 1;
   }
 }
-
-void main();

package/dist/git-worktree.cjs

@@ -48,6 +48,8 @@ class GitWorktree {
     checkpointRoot;
     cloneUrl;
     githubToken;
+    githubTokenProvider;
+    repoLocalTokenInstalled = false;
     gitGrant;
     workingBranch;
     repoLocalGithubToken;
@@ -92,6 +94,7 @@ class GitWorktree {
             ? proxyCloneUrl(options.cloneUrl, options.gitGrant.proxyBaseUrl)
             : options.cloneUrl;
         this.githubToken = options.gitGrant ? undefined : options.githubToken;
+        this.githubTokenProvider = options.gitGrant ? undefined : options.githubTokenProvider;
         this.workingBranch = options.workingBranch?.trim() || null;
         this.repoLocalGithubToken = options.repoLocalGithubToken;
         this.prContinuation = options.prContinuation ?? false;
@@ -135,13 +138,44 @@ class GitWorktree {
     async installRepoLocalGithubToken() {
         if (!this.repoLocalGithubToken)
             return;
-        if (/[\0\r]/.test(this.repoLocalGithubToken)) {
+        const token = this.githubTokenProvider?.() ?? this.repoLocalGithubToken;
+        if (/[\0\r\n]/.test(token)) {
             throw new Error("Broker-issued GitHub credential contains unsupported control characters.");
         }
         const configPath = node_path_1.default.join(this.repositoryPath, "config");
-        const block = repoLocalGithubTokenBlock(this.sessionTokenMarker, this.repoLocalGithubToken);
+        const block = repoLocalGithubTokenBlock(this.sessionTokenMarker, token);
         await node_fs_1.promises.chmod(configPath, 0o600);
         await node_fs_1.promises.appendFile(configPath, block, { encoding: "utf8", mode: 0o600 });
+        this.repoLocalTokenInstalled = true;
+    }
+    /** Serializes rotation with prepare/cleanup; never recreates a removed repository. */
+    async refreshRepoLocalGithubToken(token) {
+        if (!this.repoLocalGithubToken)
+            return;
+        if (/[\0\r\n]/.test(token))
+            throw new Error("Invalid refreshed GitHub credential");
+        await withRepositoryLock(this.repositoryPath, async () => {
+            if (!this.repoLocalTokenInstalled)
+                return;
+            const configPath = node_path_1.default.join(this.repositoryPath, "config");
+            // Cooperate with git config writers in the agent as well as parent operations.
+            const lockPath = `${configPath}.lock`;
+            const lock = await node_fs_1.promises.open(lockPath, "wx", 0o600);
+            let renamed = false;
+            try {
+                const config = await node_fs_1.promises.readFile(configPath, "utf8");
+                const clean = removeMarkedConfigBlock(config, this.sessionTokenMarker);
+                await lock.writeFile(clean + repoLocalGithubTokenBlock(this.sessionTokenMarker, token), "utf8");
+                await lock.close();
+                await node_fs_1.promises.rename(lockPath, configPath);
+                renamed = true;
+            }
+            finally {
+                await lock.close().catch(() => undefined);
+                if (!renamed)
+                    await node_fs_1.promises.rm(lockPath, { force: true });
+            }
+        });
     }
     /**
      * Installs the delivery-branch guard shared by every worktree of this cache.
@@ -688,6 +722,7 @@ class GitWorktree {
     async removeRepoLocalGithubToken() {
         if (!this.repoLocalGithubToken)
             return;
+        this.repoLocalTokenInstalled = false;
         const configPath = node_path_1.default.join(this.repositoryPath, "config");
         try {
             const config = await node_fs_1.promises.readFile(configPath, "utf8");
@@ -710,7 +745,8 @@ class GitWorktree {
             }
             return grantResult;
         }
-        const credentialArgs = authenticated && this.githubToken
+        const githubToken = this.githubTokenProvider ? this.githubTokenProvider() : this.githubToken;
+        const credentialArgs = authenticated && githubToken
             ? [
                 "-c",
                 "credential.helper=",
@@ -719,8 +755,8 @@ class GitWorktree {
             ]
             : [];
         const result = await this.runner.run("git", [...credentialArgs, ...args], {
-            env: this.githubToken
-                ? { ...process.env, GITHUB_TOKEN: this.githubToken, GIT_TERMINAL_PROMPT: "0" }
+            env: githubToken
+                ? { ...process.env, GITHUB_TOKEN: githubToken, GIT_TERMINAL_PROMPT: "0" }
                 : { ...process.env, GIT_TERMINAL_PROMPT: "0" },
         });
         if (result.code !== 0) {

package/dist/github-credential.cjs

@@ -1,7 +1,13 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GITHUB_CREDENTIAL_SECRET_NAME = void 0;
+exports.GithubTokenFileRefresher = exports.GITHUB_TOKEN_FILENAME = exports.GITHUB_TOKEN_FILE_RETRY_MS = exports.GITHUB_TOKEN_FILE_REFRESH_MS = exports.GITHUB_CREDENTIAL_SECRET_NAME = void 0;
 exports.githubCredentialDenialSummary = githubCredentialDenialSummary;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const git_grant_cjs_1 = require("./git-grant.cjs");
 /** Wire name the session requests its repository credential under. */
 exports.GITHUB_CREDENTIAL_SECRET_NAME = "github-pat";
 /**
@@ -41,3 +47,95 @@ function githubCredentialDenialSummary(denied) {
     return (`GitHub credential denied (${denial.reason}): ${explanation} ` +
         "The session stopped before cloning instead of falling back to this machine's own git login.");
 }
+/** GitHub App installation tokens live an hour; refresh well inside that. */
+exports.GITHUB_TOKEN_FILE_REFRESH_MS = 10 * 60 * 1000;
+exports.GITHUB_TOKEN_FILE_RETRY_MS = 60 * 1000;
+exports.GITHUB_TOKEN_FILENAME = "github-token";
+/**
+ * Keeps managed repository credentials current for git, gh, and parent operations.
+ * The runtime parent fetches from the broker, so the machine token never enters
+ * the agent environment. Helpers and gh only read session-owned files, including
+ * under the Codex worktree guard. Mirrors GitGrantRefresher.
+ */
+class GithubTokenFileRefresher {
+    options;
+    token;
+    get current() { return this.token; }
+    timer = null;
+    stopped = false;
+    inflight = null;
+    constructor(options) {
+        this.options = options;
+    }
+    /** Writes the session-start token and schedules broker refreshes. */
+    async start(initialToken) {
+        await this.write(initialToken);
+        this.schedule(this.options.refreshMs ?? exports.GITHUB_TOKEN_FILE_REFRESH_MS);
+    }
+    async refresh() {
+        const issued = await this.options.api.issueSecrets({
+            lease_id: this.options.leaseId,
+            secret_names: [exports.GITHUB_CREDENTIAL_SECRET_NAME],
+        });
+        const token = issued.secrets[exports.GITHUB_CREDENTIAL_SECRET_NAME];
+        if (typeof token !== "string" || token.length === 0)
+            throw new Error("broker did not issue github-pat");
+        if (this.stopped)
+            throw new Error("github token refresher stopped");
+        await this.write(token);
+    }
+    /** Stops, waits for an in-flight refresh, then removes the token file. */
+    async stopAndClean() {
+        this.stopped = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        await this.inflight?.catch(() => undefined);
+        await promises_1.default.rm(this.options.tokenFile, { force: true }).catch(() => undefined);
+        if (this.options.ghConfigDir) {
+            await promises_1.default.rm(node_path_1.default.join(this.options.ghConfigDir, "hosts.yml"), { force: true }).catch(() => undefined);
+        }
+        this.token = undefined;
+    }
+    async write(token) {
+        // Register before writing so a redaction pass never misses a live value.
+        this.options.registry.register(token);
+        if (/[\r\n\0]/.test(token))
+            throw new Error("github token contains unsupported control characters");
+        await promises_1.default.mkdir(node_path_1.default.dirname(this.options.tokenFile), { recursive: true, mode: 0o700 });
+        await (0, git_grant_cjs_1.writePrivateFile)(this.options.tokenFile, `${token}\n`);
+        if (this.options.ghConfigDir) {
+            await promises_1.default.mkdir(this.options.ghConfigDir, { recursive: true, mode: 0o700 });
+            // gh otherwise tries to migrate (and rewrite) hosts.yml inside the read-only sandbox.
+            await promises_1.default.writeFile(node_path_1.default.join(this.options.ghConfigDir, "config.yml"), "version: 1\n", { mode: 0o600, flag: "wx" })
+                .catch((error) => { if (error.code !== "EEXIST")
+                throw error; });
+            await (0, git_grant_cjs_1.writePrivateFile)(node_path_1.default.join(this.options.ghConfigDir, "hosts.yml"), (0, git_grant_cjs_1.renderGhHostsYml)("github.com", token));
+        }
+        this.token = token;
+        await this.options.onToken?.(token);
+    }
+    schedule(delayMs) {
+        if (this.stopped)
+            return;
+        this.timer = setTimeout(() => {
+            this.inflight = this.tick();
+        }, delayMs);
+        this.timer.unref?.();
+    }
+    async tick() {
+        if (this.stopped)
+            return;
+        try {
+            await this.refresh();
+            this.schedule(this.options.refreshMs ?? exports.GITHUB_TOKEN_FILE_REFRESH_MS);
+        }
+        catch (error) {
+            // The previous token stays until its own expiry; GitHub rejects it after.
+            const retryMs = this.options.retryMs ?? exports.GITHUB_TOKEN_FILE_RETRY_MS;
+            this.options.log.warn(`github token refresh failed for ${this.options.leaseId}; retrying in ${retryMs / 1000}s: ${String(error)}`);
+            this.schedule(retryMs);
+        }
+    }
+}
+exports.GithubTokenFileRefresher = GithubTokenFileRefresher;

package/dist/session.cjs

@@ -45,6 +45,7 @@ const commit_attribution_cjs_1 = require("./commit-attribution.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
 const GIT_CREDENTIAL_HELPER_FILENAME = "git-credential-navarch.cjs";
+const SESSION_GIT_GLOBAL_CONFIG_FILENAME = "gitconfig";
 const GIT_GRANT_HELPER_FILENAME = "git-credential-navarch-grant.cjs";
 const COMPLETION_REMEDIATION_RETRIES = 2;
 /**
@@ -105,13 +106,19 @@ function resolveSessionExecution(config, claimed) {
  * isolation instead; see runtime/README.md.
  */
 async function runSession(deps, claimed, sessionId) {
-    const lifecycle = { enteredMainSessionTry: false };
+    const lifecycle = { enteredMainSessionTry: false, refreshers: [] };
     try {
         return await runClaimedSession(deps, claimed, sessionId, lifecycle);
     }
     catch (err) {
         if (lifecycle.enteredMainSessionTry)
             throw err;
+        // Stop credential refreshers first: they would otherwise keep calling the
+        // broker for the lease completed below and recreate the removed files.
+        // stopAndClean waits for an in-flight refresh and is idempotent.
+        for (const refresher of lifecycle.refreshers) {
+            await refresher.stopAndClean().catch((stopErr) => log.warn(`credential refresher cleanup failed after initialization crash: ${String(stopErr)}`));
+        }
         // Initialization before the main worktree/adapter try (prompt creation,
         // broker access, MCP/guard setup) must still release the lease with the
         // explicit pre-start signal. Otherwise it waits for expiry and bypasses
@@ -185,6 +192,13 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     // The runtime parent fetches and refreshes the grant; the agent never sees
     // the machine token or a GitHub token in these modes.
     const bundleGitMode = bundle.repository?.git_proxy_mode;
+    // Codex's worktree guard is an OS sandbox around the whole agent, git's
+    // credential helper included: it denies the session dir and allows only
+    // GitHub hosts. Helpers and their token files go in a dir it may read.
+    const codexGuarded = config.sandboxMode === "host" && config.worktreeGuard && runtime === "codex";
+    const gitCredentialDir = (0, worktree_guard_cjs_1.sessionGitCredentialDir)(workDir);
+    let githubTokenRefresher;
+    const credentialConsumer = {};
     let gitGrantRefresher;
     let gitGrantEnv;
     if (bundleGitMode !== "off") {
@@ -200,9 +214,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         });
         try {
             const issue = await refresher.start();
-            const helperPath = node_path_1.default.join(workDir, GIT_GRANT_HELPER_FILENAME);
+            await node_fs_1.promises.mkdir(gitCredentialDir, { recursive: true, mode: 0o700 });
+            const helperPath = node_path_1.default.join(gitCredentialDir, GIT_GRANT_HELPER_FILENAME);
             await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch-grant.cjs"), helperPath);
             gitGrantRefresher = refresher;
+            lifecycle.refreshers.push(refresher);
             gitGrantEnv = {
                 proxyHost: issue.proxy_host,
                 proxyBaseUrl: issue.proxy_base_url,
@@ -256,14 +272,18 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     }
     let gitCredentialRefresh;
     if (!gitGrantMode && managedGithubCredential && secrets["github-pat"]) {
-        const helperPath = node_path_1.default.join(workDir, GIT_CREDENTIAL_HELPER_FILENAME);
+        await node_fs_1.promises.mkdir(gitCredentialDir, { recursive: true, mode: 0o700 });
+        const helperPath = node_path_1.default.join(gitCredentialDir, GIT_CREDENTIAL_HELPER_FILENAME);
         await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch.cjs"), helperPath);
-        gitCredentialRefresh = {
-            helperPath,
-            apiBase: api.getBaseUrl(),
-            machineToken: api.getToken() ?? "",
-            leaseId,
-        };
+        const tokenFile = node_path_1.default.join(gitCredentialDir, github_credential_cjs_1.GITHUB_TOKEN_FILENAME);
+        githubTokenRefresher = new github_credential_cjs_1.GithubTokenFileRefresher({
+            api, leaseId, tokenFile, registry, log,
+            ghConfigDir: (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir),
+            onToken: async (token) => { await credentialConsumer.worktree?.refreshRepoLocalGithubToken(token); },
+        });
+        lifecycle.refreshers.push(githubTokenRefresher);
+        await githubTokenRefresher.start(secrets["github-pat"]);
+        gitCredentialRefresh = { helperPath, tokenFile };
     }
     const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail, gitGrantEnv);
     // Proxied projects (CX-3.7): the control-plane identity replaces the
@@ -274,6 +294,15 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     const ghConfigDir = (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir);
     await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
     sessionEnv.GH_CONFIG_DIR = ghConfigDir;
+    if (codexGuarded) {
+        // The sandbox cannot read ~/.gitconfig, and git exits on an unreadable
+        // global config, so every agent git command failed until the agent found
+        // GIT_CONFIG_GLOBAL=/dev/null itself. The session file also replaces the
+        // default ~/.config/git/ignore, whose denial warns on every status.
+        await node_fs_1.promises.mkdir(gitCredentialDir, { recursive: true, mode: 0o700 });
+        sessionEnv.GIT_CONFIG_GLOBAL = node_path_1.default.join(gitCredentialDir, SESSION_GIT_GLOBAL_CONFIG_FILENAME);
+        await node_fs_1.promises.writeFile(sessionEnv.GIT_CONFIG_GLOBAL, "[core]\n\texcludesFile = /dev/null\n", { mode: 0o600 });
+    }
     if (gitGrantMode) {
         // Adapters spread process.env under this map. Blank any GitHub token the
         // runtime process itself holds so the agent cannot inherit it.
@@ -297,6 +326,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         });
         secrets = {};
         await gitGrantRefresher?.stopAndClean();
+        await githubTokenRefresher?.stopAndClean();
         await node_fs_1.promises.rm(workDir, { recursive: true, force: true }).catch(() => undefined);
         return;
     }
@@ -316,6 +346,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         sessionId,
         cloneUrl,
         githubToken,
+        githubTokenProvider: githubTokenRefresher ? () => githubTokenRefresher.current : undefined,
         workingBranch: bundle.repository?.working_branch,
         // Grant modes never expose a GitHub token, so the Codex repo-local
         // github-pat bootstrap is not installed.
@@ -330,6 +361,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         restoreHostedCheckpoint: !allowBranchRename && task.task_type !== "verify",
         ...(commitIdentity ? { ownershipCommitIdentity: commitIdentity.committer } : {}),
     });
+    credentialConsumer.worktree = gitWorktree;
     const knownGuidanceIds = new Set((bundle.guidance ?? []).map((entry) => entry.id));
     const deliveredGuidance = [...(bundle.guidance ?? [])];
     let guidanceCursor = bundle.guidance_cursor ?? null;
@@ -730,6 +762,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 workspaceRoot: config.workspaceRoot,
                 extraRoots: config.guardExtraRoots,
                 codexBin: config.codexBin,
+                credentialReadRoots: [
+                    gitCredentialDir,
+                    ...(gitGrantEnv ? [(0, git_grant_cjs_1.gitGrantPaths)(workDir).dir] : []),
+                ],
+                networkHosts: gitGrantEnv ? [gitGrantEnv.proxyHost] : [],
             });
         }
         const restoredCheckpoint = gitWorktree.restoredHostedCheckpoint;
@@ -1127,7 +1164,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                     // Keep SHA verification on the exact branch, but do not adopt a
                     // foreign-branch PR as delivery evidence for a root task.
                     allowShaFallback: allowBranchRename,
-                    githubToken: gitGrantMode ? gitGrantRefresher?.current?.grant : githubToken,
+                    githubToken: gitGrantMode ? gitGrantRefresher?.current?.grant : githubTokenRefresher?.current ?? githubToken,
                     // Grant modes read through the proxy and never use the host's own gh login.
                     apiBaseUrl: gitGrantEnv ? `${gitGrantEnv.proxyBaseUrl.replace(/\/+$/, "")}/api/v3` : undefined,
                     hostTokenProvider: gitGrantMode ? async () => undefined : undefined,
@@ -1424,9 +1461,10 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         // request. A later heartbeat response sees sessionClosing and does nothing.
         await Promise.resolve(heartbeatWorkspaceUpdate).catch(() => undefined);
         secrets = {};
-        // Waits for an in-flight refresh, then removes the grant files so none
-        // survives in a retained workspace.
+        // Waits for an in-flight refresh, then removes the grant and token files
+        // so none survives in a retained workspace.
         await gitGrantRefresher?.stopAndClean();
+        await githubTokenRefresher?.stopAndClean();
         // A sandbox teardown failure must not skip worktree cleanup: a leftover
         // task branch in the shared cache blocks the task's next retry.
         try {
@@ -1665,12 +1703,21 @@ function toEnvMap(secrets, credentialRefreshOrAuthorName, gitAuthorNameOrEmail =
         ["user.name", gitAuthorName],
         ["user.email", resolvedGitAuthorEmail],
     ];
-    if (secrets["github-pat"] && !out.GITHUB_TOKEN) {
+    if (secrets["github-pat"] && (!out.GITHUB_TOKEN || (gitCredentialRefresh && "tokenFile" in gitCredentialRefresh))) {
         out.GITHUB_TOKEN = secrets["github-pat"];
         if (gitCredentialRefresh) {
-            out.NAVARCH_GIT_CREDENTIAL_API_BASE = gitCredentialRefresh.apiBase;
-            out.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN = gitCredentialRefresh.machineToken;
-            out.NAVARCH_GIT_CREDENTIAL_LEASE_ID = gitCredentialRefresh.leaseId;
+            if ("tokenFile" in gitCredentialRefresh) {
+                out.NAVARCH_GIT_CREDENTIAL_TOKEN_FILE = gitCredentialRefresh.tokenFile;
+                // gh must read the rotating hosts.yml, including when a parent has GH_TOKEN.
+                out.GITHUB_TOKEN = "";
+                out.GH_TOKEN = "";
+                out.GH_HOST = "github.com";
+            }
+            else {
+                out.NAVARCH_GIT_CREDENTIAL_API_BASE = gitCredentialRefresh.apiBase;
+                out.NAVARCH_GIT_CREDENTIAL_MACHINE_TOKEN = gitCredentialRefresh.machineToken;
+                out.NAVARCH_GIT_CREDENTIAL_LEASE_ID = gitCredentialRefresh.leaseId;
+            }
             gitConfig.unshift(["credential.helper", ""], ["credential.helper", `!node ${shellQuote(gitCredentialRefresh.helperPath)}`]);
             out.GIT_TERMINAL_PROMPT = "0";
         }

package/dist/worktree-guard.cjs

@@ -11,6 +11,7 @@ exports.codexExecutableReadRoots = codexExecutableReadRoots;
 exports.codexHelperReadRoots = codexHelperReadRoots;
 exports.macosDeveloperWriteRoots = macosDeveloperWriteRoots;
 exports.sessionGhConfigDir = sessionGhConfigDir;
+exports.sessionGitCredentialDir = sessionGitCredentialDir;
 exports.sessionCodexTmpDir = sessionCodexTmpDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
@@ -19,6 +20,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const CODEX_GUARD_PROFILE = "navarch-worktree";
 const SESSION_GH_CONFIG_DIRNAME = "gh-config";
+const SESSION_GIT_CREDENTIAL_DIRNAME = "git-credential";
 const CODEX_GITHUB_NETWORK_DOMAINS = {
     "**.github.com": "allow",
     "**.githubusercontent.com": "allow",
@@ -378,6 +380,14 @@ function macosDeveloperWriteRoots(env = process.env, platform = process.platform
 function sessionGhConfigDir(workDir) {
     return node_path_1.default.join(workDir, SESSION_GH_CONFIG_DIRNAME);
 }
+/**
+ * Session-owned directory for git's credential helpers and the token file
+ * they read. It sits beside the session metadata, which the Codex profile
+ * denies, so it is granted read-only by name (credentialReadRoots).
+ */
+function sessionGitCredentialDir(workDir) {
+    return node_path_1.default.join(workDir, SESSION_GIT_CREDENTIAL_DIRNAME);
+}
 function sessionCodexTmpDir(workDir) {
     return node_path_1.default.resolve(workDir, "tmp");
 }
@@ -417,6 +427,16 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
         [sessionGhConfigDir(options.workDir)]: "read",
     };
+    // git runs the credential helper inside the sandbox. Without these grants
+    // the helper copied into the denied session dir looks missing, and every
+    // authenticated fetch or push fails (ShiftSwap, 2026-10-27).
+    // Only strict subdirectories of this session: never the metadata dir itself.
+    const sessionDir = node_path_1.default.resolve(options.workDir);
+    for (const root of options.credentialReadRoots ?? []) {
+        const resolved = node_path_1.default.resolve(root);
+        if (resolved !== sessionDir && isPathInside(resolved, sessionDir))
+            filesystem[resolved] = "read";
+    }
     // Codex protects a linked worktree's gitdir with a more specific read-only
     // rule. A write grant on the bare repository alone does not override it:
     // fetch/checkout/commit fail on FETCH_HEAD, HEAD.lock, or index.lock. Grant
@@ -471,7 +491,10 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
         "-c",
         `permissions.${CODEX_GUARD_PROFILE}.network.enabled=true`,
         "-c",
-        `permissions.${CODEX_GUARD_PROFILE}.network.domains=${tomlInlineTable(CODEX_GITHUB_NETWORK_DOMAINS)}`,
+        `permissions.${CODEX_GUARD_PROFILE}.network.domains=${tomlInlineTable({
+            ...CODEX_GITHUB_NETWORK_DOMAINS,
+            ...Object.fromEntries((options.networkHosts ?? []).map((host) => [host, "allow"])),
+        })}`,
     ];
 }
 function linkedWorktreeGitDir(worktreePath, repositoryPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.136",
+  "version": "0.1.138",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",