@sagentlab/navarch-runtime 0.1.137 → 0.1.139

package/dist/browser-evidence.cjs

@@ -22,18 +22,20 @@ const node_path_1 = __importDefault(require("node:path"));
 const BROWSER_USE_RUNTIMES = ["codex", "claude-code", "antigravity", "opencode", "acp", "muse"];
 /**
  * Which navarch_browser tools a host session gets. `browserUse` adds capture
- * and local_browser_* for browser-use tasks. `playwrightSuites` adds
- * start_playwright_browser to every macOS Codex build/verify/qa session,
- * because Codex's seatbelt cannot launch the project's own Playwright suite's
- * Chromium whether or not the task asked for browser-use.
+ * and local_browser_* for browser-use build/verify/qa tasks. `playwrightSuites`
+ * adds start_playwright_browser to every macOS Codex build/verify/qa/ops
+ * session, because Codex's seatbelt cannot launch the project's own Playwright
+ * suite's Chromium whether or not the task asked for browser-use. Ops tasks
+ * diagnose suite failures too (ShiftSwap issue #154).
  */
 function navarchBrowserTools(input) {
-    if (input.mcpConfigPath || input.sandboxMode !== "host" || !["build", "verify", "qa"].includes(input.taskType)) {
+    if (input.mcpConfigPath || input.sandboxMode !== "host")
         return { browserUse: false, playwrightSuites: false };
-    }
     return {
-        browserUse: input.requiredCapabilities?.includes("browser-use") === true && BROWSER_USE_RUNTIMES.includes(input.runtime),
-        playwrightSuites: input.runtime === "codex" && input.platform === "darwin",
+        browserUse: ["build", "verify", "qa"].includes(input.taskType)
+            && input.requiredCapabilities?.includes("browser-use") === true && BROWSER_USE_RUNTIMES.includes(input.runtime),
+        playwrightSuites: ["build", "verify", "qa", "ops"].includes(input.taskType)
+            && input.runtime === "codex" && input.platform === "darwin",
     };
 }
 async function installEvidenceBrowser() {
@@ -214,23 +216,25 @@ async function startBrowserEvidence(options) {
         }
         const server = new mcp_js_1.McpServer({ name: "navarch-browser", version: "1.0.0" });
         const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
-        server.registerTool("capture_visual_evidence", {
-            description: "Capture and upload desktop and mobile screenshots using Navarch's managed local browser. Works outside the coding-agent sandbox. Returns durable artifact URLs. Capture does not certify acceptance or that the URL serves the supplied commit. Evidence is automatically attached to the delivery PR at session completion.",
-            inputSchema: captureShape,
-        }, async (args) => {
-            try {
-                if (busy)
-                    throw new Error("A capture is already running. Wait for it to finish.");
-                const pending = capture(args);
-                activeCapture = pending;
-                const { captured, images } = await pending;
-                return { content: [{ type: "text", text: JSON.stringify(captured) }, ...images] };
-            }
-            catch (error) {
-                return { isError: true, content: [{ type: "text", text: String(error) }] };
-            }
-        });
-        (0, local_browser_cjs_1.registerLocalBrowserTools)(server, localBrowser);
+        if (options.browserUse !== false) {
+            server.registerTool("capture_visual_evidence", {
+                description: "Capture and upload desktop and mobile screenshots using Navarch's managed local browser. Works outside the coding-agent sandbox. Returns durable artifact URLs. Capture does not certify acceptance or that the URL serves the supplied commit. Evidence is automatically attached to the delivery PR at session completion.",
+                inputSchema: captureShape,
+            }, async (args) => {
+                try {
+                    if (busy)
+                        throw new Error("A capture is already running. Wait for it to finish.");
+                    const pending = capture(args);
+                    activeCapture = pending;
+                    const { captured, images } = await pending;
+                    return { content: [{ type: "text", text: JSON.stringify(captured) }, ...images] };
+                }
+                catch (error) {
+                    return { isError: true, content: [{ type: "text", text: String(error) }] };
+                }
+            });
+            (0, local_browser_cjs_1.registerLocalBrowserTools)(server, localBrowser);
+        }
         if (options.playwrightServer)
             (0, playwright_server_cjs_1.registerPlaywrightServerTool)(server, options.playwrightServer);
         res.on("close", () => { void transport.close(); void server.close(); });

package/dist/git-worktree.cjs

@@ -48,6 +48,8 @@ class GitWorktree {
     checkpointRoot;
     cloneUrl;
     githubToken;
+    githubTokenProvider;
+    repoLocalTokenInstalled = false;
     gitGrant;
     workingBranch;
     repoLocalGithubToken;
@@ -92,6 +94,7 @@ class GitWorktree {
             ? proxyCloneUrl(options.cloneUrl, options.gitGrant.proxyBaseUrl)
             : options.cloneUrl;
         this.githubToken = options.gitGrant ? undefined : options.githubToken;
+        this.githubTokenProvider = options.gitGrant ? undefined : options.githubTokenProvider;
         this.workingBranch = options.workingBranch?.trim() || null;
         this.repoLocalGithubToken = options.repoLocalGithubToken;
         this.prContinuation = options.prContinuation ?? false;
@@ -135,13 +138,44 @@ class GitWorktree {
     async installRepoLocalGithubToken() {
         if (!this.repoLocalGithubToken)
             return;
-        if (/[\0\r]/.test(this.repoLocalGithubToken)) {
+        const token = this.githubTokenProvider?.() ?? this.repoLocalGithubToken;
+        if (/[\0\r\n]/.test(token)) {
             throw new Error("Broker-issued GitHub credential contains unsupported control characters.");
         }
         const configPath = node_path_1.default.join(this.repositoryPath, "config");
-        const block = repoLocalGithubTokenBlock(this.sessionTokenMarker, this.repoLocalGithubToken);
+        const block = repoLocalGithubTokenBlock(this.sessionTokenMarker, token);
         await node_fs_1.promises.chmod(configPath, 0o600);
         await node_fs_1.promises.appendFile(configPath, block, { encoding: "utf8", mode: 0o600 });
+        this.repoLocalTokenInstalled = true;
+    }
+    /** Serializes rotation with prepare/cleanup; never recreates a removed repository. */
+    async refreshRepoLocalGithubToken(token) {
+        if (!this.repoLocalGithubToken)
+            return;
+        if (/[\0\r\n]/.test(token))
+            throw new Error("Invalid refreshed GitHub credential");
+        await withRepositoryLock(this.repositoryPath, async () => {
+            if (!this.repoLocalTokenInstalled)
+                return;
+            const configPath = node_path_1.default.join(this.repositoryPath, "config");
+            // Cooperate with git config writers in the agent as well as parent operations.
+            const lockPath = `${configPath}.lock`;
+            const lock = await node_fs_1.promises.open(lockPath, "wx", 0o600);
+            let renamed = false;
+            try {
+                const config = await node_fs_1.promises.readFile(configPath, "utf8");
+                const clean = removeMarkedConfigBlock(config, this.sessionTokenMarker);
+                await lock.writeFile(clean + repoLocalGithubTokenBlock(this.sessionTokenMarker, token), "utf8");
+                await lock.close();
+                await node_fs_1.promises.rename(lockPath, configPath);
+                renamed = true;
+            }
+            finally {
+                await lock.close().catch(() => undefined);
+                if (!renamed)
+                    await node_fs_1.promises.rm(lockPath, { force: true });
+            }
+        });
     }
     /**
      * Installs the delivery-branch guard shared by every worktree of this cache.
@@ -688,6 +722,7 @@ class GitWorktree {
     async removeRepoLocalGithubToken() {
         if (!this.repoLocalGithubToken)
             return;
+        this.repoLocalTokenInstalled = false;
         const configPath = node_path_1.default.join(this.repositoryPath, "config");
         try {
             const config = await node_fs_1.promises.readFile(configPath, "utf8");
@@ -710,7 +745,8 @@ class GitWorktree {
             }
             return grantResult;
         }
-        const credentialArgs = authenticated && this.githubToken
+        const githubToken = this.githubTokenProvider ? this.githubTokenProvider() : this.githubToken;
+        const credentialArgs = authenticated && githubToken
             ? [
                 "-c",
                 "credential.helper=",
@@ -719,8 +755,8 @@ class GitWorktree {
             ]
             : [];
         const result = await this.runner.run("git", [...credentialArgs, ...args], {
-            env: this.githubToken
-                ? { ...process.env, GITHUB_TOKEN: this.githubToken, GIT_TERMINAL_PROMPT: "0" }
+            env: githubToken
+                ? { ...process.env, GITHUB_TOKEN: githubToken, GIT_TERMINAL_PROMPT: "0" }
                 : { ...process.env, GIT_TERMINAL_PROMPT: "0" },
         });
         if (result.code !== 0) {

package/dist/github-credential.cjs

@@ -52,14 +52,15 @@ exports.GITHUB_TOKEN_FILE_REFRESH_MS = 10 * 60 * 1000;
 exports.GITHUB_TOKEN_FILE_RETRY_MS = 60 * 1000;
 exports.GITHUB_TOKEN_FILENAME = "github-token";
 /**
- * Keeps a managed repository's installation token in a session file for
- * agents whose OS sandbox cannot reach the Navarch API (the Codex worktree
- * guard allows only GitHub hosts). The runtime parent fetches from the broker,
- * so the machine token never enters the agent environment, and the credential
- * helper only reads the file. Mirrors GitGrantRefresher.
+ * Keeps managed repository credentials current for git, gh, and parent operations.
+ * The runtime parent fetches from the broker, so the machine token never enters
+ * the agent environment. Helpers and gh only read session-owned files, including
+ * under the Codex worktree guard. Mirrors GitGrantRefresher.
  */
 class GithubTokenFileRefresher {
     options;
+    token;
+    get current() { return this.token; }
     timer = null;
     stopped = false;
     inflight = null;
@@ -91,6 +92,10 @@ class GithubTokenFileRefresher {
         this.timer = null;
         await this.inflight?.catch(() => undefined);
         await promises_1.default.rm(this.options.tokenFile, { force: true }).catch(() => undefined);
+        if (this.options.ghConfigDir) {
+            await promises_1.default.rm(node_path_1.default.join(this.options.ghConfigDir, "hosts.yml"), { force: true }).catch(() => undefined);
+        }
+        this.token = undefined;
     }
     async write(token) {
         // Register before writing so a redaction pass never misses a live value.
@@ -99,6 +104,16 @@ class GithubTokenFileRefresher {
             throw new Error("github token contains unsupported control characters");
         await promises_1.default.mkdir(node_path_1.default.dirname(this.options.tokenFile), { recursive: true, mode: 0o700 });
         await (0, git_grant_cjs_1.writePrivateFile)(this.options.tokenFile, `${token}\n`);
+        if (this.options.ghConfigDir) {
+            await promises_1.default.mkdir(this.options.ghConfigDir, { recursive: true, mode: 0o700 });
+            // gh otherwise tries to migrate (and rewrite) hosts.yml inside the read-only sandbox.
+            await promises_1.default.writeFile(node_path_1.default.join(this.options.ghConfigDir, "config.yml"), "version: 1\n", { mode: 0o600, flag: "wx" })
+                .catch((error) => { if (error.code !== "EEXIST")
+                throw error; });
+            await (0, git_grant_cjs_1.writePrivateFile)(node_path_1.default.join(this.options.ghConfigDir, "hosts.yml"), (0, git_grant_cjs_1.renderGhHostsYml)("github.com", token));
+        }
+        this.token = token;
+        await this.options.onToken?.(token);
     }
     schedule(delayMs) {
         if (this.stopped)

package/dist/playwright-server.cjs

@@ -259,7 +259,11 @@ function createPlaywrightServer(options) {
             canonicalCore,
             token,
         ];
-        const childEnv = { TMPDIR: params.PRIVATE };
+        // Chromium's macOS temp dir ignores TMPDIR and falls back to the user's
+        // /var/folders/.../T, which the profile does not let it write. Every
+        // download creates a temp file there first, so without this each one
+        // ended `canceled` (ShiftSwap issue #154).
+        const childEnv = { TMPDIR: params.PRIVATE, MAC_CHROMIUM_TMPDIR: params.PRIVATE };
         for (const name of ["HOME", "PATH", "LANG", "PLAYWRIGHT_BROWSERS_PATH"]) {
             if (env[name] !== undefined)
                 childEnv[name] = env[name];

package/dist/session.cjs

@@ -106,13 +106,19 @@ function resolveSessionExecution(config, claimed) {
  * isolation instead; see runtime/README.md.
  */
 async function runSession(deps, claimed, sessionId) {
-    const lifecycle = { enteredMainSessionTry: false };
+    const lifecycle = { enteredMainSessionTry: false, refreshers: [] };
     try {
         return await runClaimedSession(deps, claimed, sessionId, lifecycle);
     }
     catch (err) {
         if (lifecycle.enteredMainSessionTry)
             throw err;
+        // Stop credential refreshers first: they would otherwise keep calling the
+        // broker for the lease completed below and recreate the removed files.
+        // stopAndClean waits for an in-flight refresh and is idempotent.
+        for (const refresher of lifecycle.refreshers) {
+            await refresher.stopAndClean().catch((stopErr) => log.warn(`credential refresher cleanup failed after initialization crash: ${String(stopErr)}`));
+        }
         // Initialization before the main worktree/adapter try (prompt creation,
         // broker access, MCP/guard setup) must still release the lease with the
         // explicit pre-start signal. Otherwise it waits for expiry and bypasses
@@ -192,6 +198,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     const codexGuarded = config.sandboxMode === "host" && config.worktreeGuard && runtime === "codex";
     const gitCredentialDir = (0, worktree_guard_cjs_1.sessionGitCredentialDir)(workDir);
     let githubTokenRefresher;
+    const credentialConsumer = {};
     let gitGrantRefresher;
     let gitGrantEnv;
     if (bundleGitMode !== "off") {
@@ -211,6 +218,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             const helperPath = node_path_1.default.join(gitCredentialDir, GIT_GRANT_HELPER_FILENAME);
             await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch-grant.cjs"), helperPath);
             gitGrantRefresher = refresher;
+            lifecycle.refreshers.push(refresher);
             gitGrantEnv = {
                 proxyHost: issue.proxy_host,
                 proxyBaseUrl: issue.proxy_base_url,
@@ -267,20 +275,15 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         await node_fs_1.promises.mkdir(gitCredentialDir, { recursive: true, mode: 0o700 });
         const helperPath = node_path_1.default.join(gitCredentialDir, GIT_CREDENTIAL_HELPER_FILENAME);
         await node_fs_1.promises.copyFile(node_path_1.default.resolve(__dirname, "../bin/git-credential-navarch.cjs"), helperPath);
-        if (codexGuarded) {
-            const tokenFile = node_path_1.default.join(gitCredentialDir, github_credential_cjs_1.GITHUB_TOKEN_FILENAME);
-            githubTokenRefresher = new github_credential_cjs_1.GithubTokenFileRefresher({ api, leaseId, tokenFile, registry, log });
-            await githubTokenRefresher.start(secrets["github-pat"]);
-            gitCredentialRefresh = { helperPath, tokenFile };
-        }
-        else {
-            gitCredentialRefresh = {
-                helperPath,
-                apiBase: api.getBaseUrl(),
-                machineToken: api.getToken() ?? "",
-                leaseId,
-            };
-        }
+        const tokenFile = node_path_1.default.join(gitCredentialDir, github_credential_cjs_1.GITHUB_TOKEN_FILENAME);
+        githubTokenRefresher = new github_credential_cjs_1.GithubTokenFileRefresher({
+            api, leaseId, tokenFile, registry, log,
+            ghConfigDir: (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir),
+            onToken: async (token) => { await credentialConsumer.worktree?.refreshRepoLocalGithubToken(token); },
+        });
+        lifecycle.refreshers.push(githubTokenRefresher);
+        await githubTokenRefresher.start(secrets["github-pat"]);
+        gitCredentialRefresh = { helperPath, tokenFile };
     }
     const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail, gitGrantEnv);
     // Proxied projects (CX-3.7): the control-plane identity replaces the
@@ -343,6 +346,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         sessionId,
         cloneUrl,
         githubToken,
+        githubTokenProvider: githubTokenRefresher ? () => githubTokenRefresher.current : undefined,
         workingBranch: bundle.repository?.working_branch,
         // Grant modes never expose a GitHub token, so the Codex repo-local
         // github-pat bootstrap is not installed.
@@ -357,6 +361,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         restoreHostedCheckpoint: !allowBranchRename && task.task_type !== "verify",
         ...(commitIdentity ? { ownershipCommitIdentity: commitIdentity.committer } : {}),
     });
+    credentialConsumer.worktree = gitWorktree;
     const knownGuidanceIds = new Set((bundle.guidance ?? []).map((entry) => entry.id));
     const deliveredGuidance = [...(bundle.guidance ?? [])];
     let guidanceCursor = bundle.guidance_cursor ?? null;
@@ -726,7 +731,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 registry.register(playwrightServer.token);
             browserEvidence = await (0, browser_evidence_cjs_1.startBrowserEvidence)({
                 apiBase: api.getBaseUrl(), machineToken: api.getToken() ?? "", leaseId,
-                isActive, playwrightServer,
+                isActive, playwrightServer, browserUse,
             });
             registry.register(browserEvidence.token);
             const mcp = JSON.parse(await node_fs_1.promises.readFile(mcpConfigPath, "utf8"));
@@ -1159,7 +1164,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                     // Keep SHA verification on the exact branch, but do not adopt a
                     // foreign-branch PR as delivery evidence for a root task.
                     allowShaFallback: allowBranchRename,
-                    githubToken: gitGrantMode ? gitGrantRefresher?.current?.grant : githubToken,
+                    githubToken: gitGrantMode ? gitGrantRefresher?.current?.grant : githubTokenRefresher?.current ?? githubToken,
                     // Grant modes read through the proxy and never use the host's own gh login.
                     apiBaseUrl: gitGrantEnv ? `${gitGrantEnv.proxyBaseUrl.replace(/\/+$/, "")}/api/v3` : undefined,
                     hostTokenProvider: gitGrantMode ? async () => undefined : undefined,
@@ -1698,11 +1703,15 @@ function toEnvMap(secrets, credentialRefreshOrAuthorName, gitAuthorNameOrEmail =
         ["user.name", gitAuthorName],
         ["user.email", resolvedGitAuthorEmail],
     ];
-    if (secrets["github-pat"] && !out.GITHUB_TOKEN) {
+    if (secrets["github-pat"] && (!out.GITHUB_TOKEN || (gitCredentialRefresh && "tokenFile" in gitCredentialRefresh))) {
         out.GITHUB_TOKEN = secrets["github-pat"];
         if (gitCredentialRefresh) {
             if ("tokenFile" in gitCredentialRefresh) {
                 out.NAVARCH_GIT_CREDENTIAL_TOKEN_FILE = gitCredentialRefresh.tokenFile;
+                // gh must read the rotating hosts.yml, including when a parent has GH_TOKEN.
+                out.GITHUB_TOKEN = "";
+                out.GH_TOKEN = "";
+                out.GH_HOST = "github.com";
             }
             else {
                 out.NAVARCH_GIT_CREDENTIAL_API_BASE = gitCredentialRefresh.apiBase;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.137",
+  "version": "0.1.139",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",