@sagentlab/navarch-runtime 0.1.142 → 0.1.144

package/README.md

@@ -592,7 +592,7 @@ unchanged across the deployment.
 | `NAVARCH_MCP_CONFIG_PATH` | — | Path to the platform MCP config passed as `--mcp-config`. |
 | `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable it for every runtime on the machine — required to run OpenCode or Muse on an already-isolated host. |
 | `NAVARCH_NAVI_CONVERSATIONS` | on | Serve read-only Navi repository conversations on this machine. Only the `claude-code` adapter on the host sandbox with the worktree guard on is supported; `navarch-runtime doctor` prints the `navi_chat:` state and reason. Set `off` to stop polling for conversations. |
-| `NAVARCH_NAVI_WORKSPACE_CHAT` | off | Explicitly enable writable Navi chat on a supported Claude Code host runtime. Generated Claude Code host connect and supervise commands include it; remove it from both lines to keep chat read-only. Owners can choose **Edit and run commands**; automatic permission review and the worktree guard remain active. Commands run on this host, not in a hard sandbox. Changes stay under `<workspaceRoot>/chat-workspaces/<conversationId>/repo` until the operator removes them. See [workspace chat](../docs/navarch/navi-workspace-chat.md). |
+| `NAVARCH_NAVI_WORKSPACE_CHAT` | off | Explicitly enable writable Navi chat on a supported Claude Code or Codex host runtime. Generated host connect and supervise commands for both adapters include it; remove it from both lines to keep chat read-only. Owners can choose **Edit and run commands**; Claude uses automatic permission review and its worktree hook, while Codex uses a native checkout permission profile with escalation disabled. Commands run on this host, not in a hard sandbox. Changes stay under `<workspaceRoot>/chat-workspaces/<conversationId>/repo` until the operator removes them. See [workspace chat](../docs/navarch/navi-workspace-chat.md). |
 | `NAVARCH_CONVERSATION_POLL_MS` | `5000` | Idle poll interval for queued conversation turns (1000–30000). |
 | `NAVARCH_CONVERSATION_MIRROR` | on | Seed new conversation checkouts from a per-repository mirror under `<workspaceRoot>/conversation-mirrors/` (fetch + local clone with independent object files) instead of a full network clone. Set `off` to always clone directly. |
 | `NAVARCH_CONVERSATION_TURN_TIMEOUT_MS` | `540000` | Time limit for one conversation turn's agent process (at most nine minutes). |

package/dist/adapters/claude-conversation.cjs

@@ -3,10 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeConversationRunner = exports.ClaudeStreamParser = exports.CLAUDE_WORKSPACE_TOOLS = exports.CLAUDE_CONVERSATION_TOOLS = void 0;
 exports.claudeConversationArgs = claudeConversationArgs;
 exports.runClaudeConversationTurn = runClaudeConversationTurn;
-const node_child_process_1 = require("node:child_process");
-const node_perf_hooks_1 = require("node:perf_hooks");
-const kill_agent_cjs_1 = require("../kill-agent.cjs");
-const session_processes_cjs_1 = require("../session-processes.cjs");
+const conversation_process_cjs_1 = require("./conversation-process.cjs");
 /**
  * Read-only tools a Navi repository question may use. Anything not listed
  * (Bash, Edit, Write, WebFetch, Task, MCP tools) is absent from the model's
@@ -17,7 +14,6 @@ const session_processes_cjs_1 = require("../session-processes.cjs");
  */
 exports.CLAUDE_CONVERSATION_TOOLS = "Read,Grep,Glob";
 exports.CLAUDE_WORKSPACE_TOOLS = "Read,Grep,Glob,Edit,Write,Bash";
-const STDERR_TAIL_BYTES = 8 * 1024;
 /**
  * Incremental parser for `claude -p --output-format stream-json --verbose
  * --include-partial-messages`. Chunks may split a record anywhere. Text is
@@ -194,90 +190,17 @@ function claudeConversationArgs(options) {
     return args;
 }
 async function runClaudeConversationTurn(options) {
-    const idle = (aborted) => ({
-        exitCode: null, timedOut: false, aborted, succeeded: false, firstEventMs: null, firstTextMs: null, stderr: "",
-    });
-    if (options.signal.aborted)
-        return idle(true);
-    const startedAt = node_perf_hooks_1.performance.now();
-    let firstEventMs = null;
-    let firstTextMs = null;
-    let timedOut = false;
-    let aborted = false;
-    let closed = false;
-    let stderr = "";
-    const deliver = (event) => {
-        // After stop, timeout or exit, late output must not reach the caller.
-        if (closed || aborted || timedOut)
-            return;
-        if (event.type === "text" && firstTextMs === null)
-            firstTextMs = node_perf_hooks_1.performance.now() - startedAt;
-        options.onEvent(event);
-    };
-    const parser = new ClaudeStreamParser(deliver, () => {
-        if (firstEventMs === null)
-            firstEventMs = node_perf_hooks_1.performance.now() - startedAt;
-    });
-    return new Promise((resolve) => {
-        const child = (0, node_child_process_1.spawn)(options.bin, claudeConversationArgs(options), {
-            detached: process.platform !== "win32",
-            cwd: options.cwd,
-            env: options.env,
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        child.stdin?.on("error", () => undefined);
-        child.stdin?.end(options.prompt);
-        options.onProcessStarted?.(child.pid);
-        const timer = options.timeoutMs > 0 ? setTimeout(() => {
-            timedOut = true;
-            (0, kill_agent_cjs_1.killAgent)(child);
-        }, options.timeoutMs) : undefined;
-        const onAbort = () => {
-            aborted = true;
-            (0, kill_agent_cjs_1.killAgent)(child);
-        };
-        options.signal.addEventListener("abort", onAbort, { once: true });
-        child.stdout.setEncoding("utf8");
-        child.stdout.on("data", (chunk) => {
-            parser.push(chunk);
-        });
-        child.stderr.setEncoding("utf8");
-        child.stderr.on("data", (chunk) => {
-            stderr = (stderr + chunk).slice(-STDERR_TAIL_BYTES);
-        });
-        const finish = (exitCode) => {
-            if (closed)
-                return;
-            parser.flush();
-            // An answer delivered only in the final result record (no stream deltas).
-            if (!parser.hasEmittedText && parser.result && !parser.result.isError && parser.result.text) {
-                deliver({ type: "text", text: parser.result.text });
-            }
-            closed = true;
-            clearTimeout(timer);
-            options.signal.removeEventListener("abort", onAbort);
-            resolve({
-                exitCode, timedOut, aborted,
-                succeeded: exitCode === 0 && !aborted && !timedOut && !!parser.result && !parser.result.isError,
-                firstEventMs, firstTextMs, stderr,
-            });
+    return (0, conversation_process_cjs_1.runConversationProcess)(options, claudeConversationArgs(options), (emit, onRecord) => {
+        const parser = new ClaudeStreamParser(emit, onRecord);
+        return {
+            push: (chunk) => parser.push(chunk),
+            flush: () => {
+                parser.flush();
+                if (!parser.hasEmittedText && parser.result && !parser.result.isError && parser.result.text)
+                    emit({ type: "text", text: parser.result.text });
+            },
+            get succeeded() { return !!parser.result && !parser.result.isError; },
         };
-        child.on("error", (err) => {
-            stderr = (stderr + `\n${String(err)}`).slice(-STDERR_TAIL_BYTES);
-            finish(null);
-        });
-        let cleanup = Promise.resolve();
-        child.on("exit", () => {
-            if (options.mode !== "workspace")
-                return;
-            (0, kill_agent_cjs_1.killAgent)(child);
-            // Start on exit, not close: a detached tool may still hold the output
-            // pipes open. Reap only this checkout before acknowledging the turn.
-            cleanup = (0, session_processes_cjs_1.reapSessionProcesses)(options.cwd);
-        });
-        child.on("close", (code) => { void cleanup.then(() => finish(code)); });
-        if (options.signal.aborted)
-            onAbort();
     });
 }
 exports.claudeConversationRunner = { run: runClaudeConversationTurn };

package/dist/adapters/codex-conversation.cjs

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexConversationRunner = exports.CodexConversationParser = void 0;
+exports.codexConversationArgs = codexConversationArgs;
+const conversation_process_cjs_1 = require("./conversation-process.cjs");
+/** Codex emits completed assistant messages; reasoning and command output stay local. */
+class CodexConversationParser {
+    emit;
+    onRecord;
+    buffer = "";
+    emitted = false;
+    seen = new Set();
+    completed = false;
+    failed = false;
+    get succeeded() { return this.completed && !this.failed; }
+    constructor(emit, onRecord = () => undefined) {
+        this.emit = emit;
+        this.onRecord = onRecord;
+    }
+    push(chunk) {
+        this.buffer += chunk;
+        if (this.buffer.length > 2_000_000) {
+            this.failed = true;
+            this.buffer = "";
+            return;
+        }
+        let end;
+        while ((end = this.buffer.indexOf("\n")) >= 0) {
+            this.record(this.buffer.slice(0, end));
+            this.buffer = this.buffer.slice(end + 1);
+        }
+    }
+    flush() { if (this.buffer.trim())
+        this.record(this.buffer); this.buffer = ""; }
+    record(line) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (!event || typeof event !== "object")
+            return;
+        this.onRecord();
+        if (event.type === "turn.failed" || event.type === "error") {
+            this.failed = true;
+            this.emit({ type: "failure", reason: "codex_turn_failed" });
+        }
+        else if (event.type === "turn.completed")
+            this.completed = true;
+        else if (event.type === "item.completed") {
+            const item = event.item;
+            if (item?.type !== "agent_message" || typeof item.text !== "string" || !item.text)
+                return;
+            if (typeof item.id === "string") {
+                if (this.seen.has(item.id))
+                    return;
+                this.seen.add(item.id);
+            }
+            this.emit({ type: "text", text: `${this.emitted ? "\n\n" : ""}${item.text}` });
+            this.emitted = true;
+        }
+    }
+}
+exports.CodexConversationParser = CodexConversationParser;
+function codexConversationArgs(options) {
+    if (!options.codexGuardArgs?.length)
+        throw new Error("Codex chat requires a native checkout permission profile.");
+    if (options.mode && options.mode !== "read_only" && options.mode !== "workspace")
+        throw new Error("Unknown conversation mode.");
+    return [
+        "exec", "-", "--json", "--ephemeral", "--ignore-rules",
+        ...options.codexGuardArgs,
+        "-c", 'approval_policy="never"',
+        "-c", `projects.${JSON.stringify(options.cwd)}.trust_level="untrusted"`,
+        "-c", 'mcp_servers={}',
+        "-c", 'features.multi_agent=false',
+        "-c", 'web_search="disabled"',
+        ...(options.model ? ["--model", options.model] : []),
+    ];
+}
+exports.codexConversationRunner = {
+    run: (options) => (0, conversation_process_cjs_1.runConversationProcess)(options, codexConversationArgs(options), (emit, onRecord) => new CodexConversationParser(emit, onRecord)),
+};

package/dist/adapters/codex.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.codexAdapter = void 0;
 exports.runCodexAdapter = runCodexAdapter;
 exports.hasExplicitPermissionPolicy = hasExplicitPermissionPolicy;
+const codex_conversation_cjs_1 = require("./codex-conversation.cjs");
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
@@ -368,6 +369,7 @@ function shellQuote(value) {
 exports.codexAdapter = {
     agentType: "codex",
     run: runCodexAdapter,
+    conversation: codex_conversation_cjs_1.codexConversationRunner,
     resumesTurns: true,
     steering: types_cjs_1.TURN_RESTART_STEERING,
     // `exec resume` reports the thread's total_token_usage, not the turn's.

package/dist/adapters/conversation-process.cjs

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runConversationProcess = runConversationProcess;
+const node_child_process_1 = require("node:child_process");
+const node_perf_hooks_1 = require("node:perf_hooks");
+const kill_agent_cjs_1 = require("../kill-agent.cjs");
+const session_processes_cjs_1 = require("../session-processes.cjs");
+const STDERR_TAIL_BYTES = 8 * 1024;
+async function runConversationProcess(options, args, makeParser) {
+    const idle = (aborted) => ({
+        exitCode: null, timedOut: false, aborted, succeeded: false, firstEventMs: null, firstTextMs: null, stderr: "",
+    });
+    if (options.signal.aborted)
+        return idle(true);
+    const startedAt = node_perf_hooks_1.performance.now();
+    let firstEventMs = null;
+    let firstTextMs = null;
+    let timedOut = false;
+    let aborted = false;
+    let closed = false;
+    let stderr = "";
+    const deliver = (event) => {
+        // After stop, timeout or exit, late output must not reach the caller.
+        if (closed || aborted || timedOut)
+            return;
+        if (event.type === "text" && firstTextMs === null)
+            firstTextMs = node_perf_hooks_1.performance.now() - startedAt;
+        options.onEvent(event);
+    };
+    const parser = makeParser(deliver, () => {
+        if (firstEventMs === null)
+            firstEventMs = node_perf_hooks_1.performance.now() - startedAt;
+    });
+    return new Promise((resolve) => {
+        const child = (0, node_child_process_1.spawn)(options.bin, args, {
+            detached: process.platform !== "win32",
+            cwd: options.cwd,
+            env: options.env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(options.prompt);
+        options.onProcessStarted?.(child.pid);
+        const timer = options.timeoutMs > 0 ? setTimeout(() => {
+            timedOut = true;
+            (0, kill_agent_cjs_1.killAgent)(child);
+        }, options.timeoutMs) : undefined;
+        const onAbort = () => {
+            aborted = true;
+            (0, kill_agent_cjs_1.killAgent)(child);
+        };
+        options.signal.addEventListener("abort", onAbort, { once: true });
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            parser.push(chunk);
+        });
+        child.stderr.setEncoding("utf8");
+        child.stderr.on("data", (chunk) => {
+            stderr = (stderr + chunk).slice(-STDERR_TAIL_BYTES);
+        });
+        const finish = (exitCode) => {
+            if (closed)
+                return;
+            parser.flush();
+            closed = true;
+            clearTimeout(timer);
+            options.signal.removeEventListener("abort", onAbort);
+            resolve({
+                exitCode, timedOut, aborted,
+                succeeded: exitCode === 0 && !aborted && !timedOut && parser.succeeded,
+                firstEventMs, firstTextMs, stderr,
+            });
+        };
+        child.on("error", (err) => {
+            stderr = (stderr + `\n${String(err)}`).slice(-STDERR_TAIL_BYTES);
+            finish(null);
+        });
+        let cleanup = Promise.resolve();
+        child.on("exit", () => {
+            if (options.mode !== "workspace")
+                return;
+            (0, kill_agent_cjs_1.killAgent)(child);
+            // Start on exit, not close: a detached tool may still hold the output
+            // pipes open. Reap only this checkout before acknowledging the turn.
+            cleanup = (0, session_processes_cjs_1.reapSessionProcesses)(options.cwd);
+        });
+        child.on("close", (code) => { void cleanup.then(() => finish(code)); });
+        if (options.signal.aborted)
+            onAbort();
+    });
+}

package/dist/conversation/loop.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConversationLoop = void 0;
+const node_fs_1 = require("node:fs");
 const index_cjs_1 = require("../adapters/index.cjs");
 const logger_cjs_1 = require("../logger.cjs");
 const worktree_guard_cjs_1 = require("../worktree-guard.cjs");
@@ -216,7 +217,7 @@ class ConversationLoop {
             machineId,
             journal: this.journal,
             adapter: (0, index_cjs_1.selectAdapter)(config.agentType),
-            bin: config.claudeBin,
+            bin: config.agentType === "codex" ? config.codexBin : config.claudeBin,
             ...(config.model ? { model: config.model } : {}),
             env,
             turnTimeoutMs: config.conversationTurnTimeoutMs,
@@ -224,12 +225,27 @@ class ConversationLoop {
             ...(shutdownSignal ? { signal: shutdownSignal } : {}),
             ...this.options.turnOverrides,
             log: this.log,
-            prepareWorkspace: async ({ conversationId, repositoryUrl, workingBranch, mode, signal }) => {
+            prepareWorkspace: async ({ conversationId, repositoryUrl, workingBranch, gitCredential, mode, signal }) => {
+                if (!gitCredential)
+                    throw new Error("Control plane did not provide the conversation Git credential");
                 const workspace = await (0, workspace_cjs_1.prepareConversationWorkspace)({
-                    workspaceRoot: config.workspaceRoot, conversationId, repositoryUrl, workingBranch, env, signal, mode,
+                    workspaceRoot: config.workspaceRoot, conversationId, repositoryUrl, workingBranch, gitCredential, env, signal, mode,
                     ...(this.options.gitRunner ? { runner: this.options.gitRunner } : {}),
                     ...(this.mirrors ? { mirrors: this.mirrors } : {}),
                 });
+                if (config.agentType === "codex") {
+                    const tmp = (0, worktree_guard_cjs_1.sessionCodexTmpDir)(workspace.metaDir);
+                    await node_fs_1.promises.mkdir(tmp, { recursive: true, mode: 0o700 });
+                    return {
+                        cwd: workspace.checkout, settingsPath: null, env: { TMPDIR: tmp, TMP: tmp, TEMP: tmp },
+                        codexGuardArgs: (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
+                            workDir: workspace.metaDir, worktreePath: workspace.checkout,
+                            repositoryPath: workspace.checkout, workspaceRoot: config.workspaceRoot,
+                            // Chat never imports operator extra roots or task credentials.
+                            codexBin: config.codexBin, readOnly: mode !== "workspace",
+                        }),
+                    };
+                }
                 const guard = await (0, worktree_guard_cjs_1.prepareWorktreeGuard)({
                     workDir: workspace.metaDir,
                     worktreePath: workspace.checkout,

package/dist/conversation/prompt.cjs

@@ -32,7 +32,7 @@ const WORKSPACE_INSTRUCTIONS = [
  * session, so a follow-up works the same after a runtime restart and no
  * unbounded transcript is kept on disk.
  */
-function buildConversationPrompt(snapshot, turnId) {
+function buildConversationPrompt(snapshot, turnId, readCommands = false) {
     const index = snapshot.turns.findIndex((turn) => turn.id === turnId);
     const current = snapshot.turns[index];
     if (!current || current.status !== "running")
@@ -56,7 +56,9 @@ function buildConversationPrompt(snapshot, turnId) {
     }
     const omitted = prior.length - kept.length;
     return [
-        snapshot.mode === "workspace" ? WORKSPACE_INSTRUCTIONS : INSTRUCTIONS,
+        snapshot.mode === "workspace" ? WORKSPACE_INSTRUCTIONS : readCommands
+            ? INSTRUCTIONS.replace("You cannot edit files, run commands,", "You may run sandboxed read-only inspection commands. You cannot edit files, run mutating commands,")
+            : INSTRUCTIONS,
         kept.length || omitted
             ? `\nEarlier conversation${omitted ? ` (${omitted} older turn${omitted === 1 ? "" : "s"} omitted)` : ""}:\n${kept.join("\n\n")}`
             : "",

package/dist/conversation/turn-runner.cjs

@@ -297,10 +297,10 @@ async function runConversationTurn(deps, conversationId, turnId) {
                 throw new Error("Unknown conversation mode");
             if (snapshot.mode === "workspace" && !deps.workspaceEnabled)
                 throw new Error("Workspace chat is disabled on this machine");
-            prompt = (0, prompt_cjs_1.buildConversationPrompt)(snapshot, journal.turnId);
+            prompt = (0, prompt_cjs_1.buildConversationPrompt)(snapshot, journal.turnId, deps.adapter.agentType === "codex");
             // Older servers omit the working branch: the checkout stays on the default branch.
             const workingBranch = (0, workspace_cjs_1.validWorkingBranch)(claim.workingBranch);
-            prepared = await deps.prepareWorkspace({ conversationId, repositoryUrl, workingBranch, mode: snapshot.mode ?? "read_only", signal: controller.signal });
+            prepared = await deps.prepareWorkspace({ conversationId, repositoryUrl, workingBranch, gitCredential: claim.gitCredential, mode: snapshot.mode ?? "read_only", signal: controller.signal });
         }
         catch (error) {
             if (!run.lost)
@@ -313,7 +313,7 @@ async function runConversationTurn(deps, conversationId, turnId) {
             run.launchedAt = node_perf_hooks_1.performance.now();
             const result = await deps.adapter.conversation.run({
                 prompt, bin: deps.bin, ...(deps.model ? { model: deps.model } : {}),
-                cwd: prepared.cwd, env: deps.env, settingsPath: prepared.settingsPath, mode: snapshot?.mode ?? "read_only",
+                cwd: prepared.cwd, env: { ...deps.env, ...prepared.env }, settingsPath: prepared.settingsPath, codexGuardArgs: prepared.codexGuardArgs, mode: snapshot?.mode ?? "read_only",
                 timeoutMs: deps.turnTimeoutMs, signal: controller.signal, onEvent,
             });
             metrics = { firstEventMs: result.firstEventMs, firstTextMs: result.firstTextMs };

package/dist/conversation/workspace.cjs

@@ -76,9 +76,8 @@ function conversationRoot(workspaceRoot, conversationId) {
  * The first turn clones; later turns of the same conversation reuse the
  * checkout so a follow-up sees the same revision as the first answer.
  *
- * The clone uses the machine's own git credentials (the same ones a local
- * `git clone` would use), never a Navarch server-side provider credential.
- * A repository this machine cannot read fails the turn instead of falling back.
+ * The control plane's project credential is used only by Git checkout subprocesses.
+ * It never enters the checkout URL, git config, journal or agent environment.
  * With `mirrors`, a new checkout is seeded from this machine's refreshed
  * mirror of the repository instead of a full network clone (see mirror.cts).
  */
@@ -127,15 +126,36 @@ async function prepareConversationWorkspace(options) {
         GIT_CONFIG_COUNT: "1",
         GIT_CONFIG_KEY_0: "core.hooksPath",
         GIT_CONFIG_VALUE_0: process.platform === "win32" ? "NUL" : "/dev/null",
+        ...(options.gitCredential ? {
+            NAVARCH_CONVERSATION_GIT_TOKEN: options.gitCredential,
+            GIT_CONFIG_COUNT: "5",
+            GIT_CONFIG_KEY_1: "credential.helper", GIT_CONFIG_VALUE_1: "",
+            GIT_CONFIG_KEY_2: `credential.${url}.helper`,
+            GIT_CONFIG_VALUE_2: `!f() { if [ "$1" = get ]; then printf '%s\\n' 'username=x-access-token' "password=$NAVARCH_CONVERSATION_GIT_TOKEN"; fi; }; f`,
+            GIT_CONFIG_KEY_3: "credential.useHttpPath", GIT_CONFIG_VALUE_3: "true",
+            GIT_CONFIG_KEY_4: "http.followRedirects", GIT_CONFIG_VALUE_4: "false",
+        } : {}),
     };
-    const seeded = await options.mirrors?.seedCheckout({ url, branch, checkout: workspace.checkout, env, signal: options.signal }) ?? false;
+    let seeded;
+    try {
+        seeded = await options.mirrors?.seedCheckout({ url, branch, checkout: workspace.checkout, env, signal: options.signal }) ?? false;
+    }
+    catch {
+        throw new Error("Conversation git mirror checkout could not run");
+    }
     if (!seeded) {
-        const result = await runner.run("git", ["clone", "--quiet", "--filter=blob:none", "--no-tags", ...(branch ? ["--branch", branch] : []), "--", url, workspace.checkout], { cwd: root, env, timeoutMs: CLONE_TIMEOUT_MS, signal: options.signal });
+        let result;
+        try {
+            result = await runner.run("git", ["clone", "--quiet", "--filter=blob:none", "--no-tags", ...(branch ? ["--branch", branch] : []), "--", url, workspace.checkout], { cwd: root, env, timeoutMs: CLONE_TIMEOUT_MS, signal: options.signal });
+        }
+        catch {
+            // A command runner or credential helper can put secrets in an exception.
+            throw new Error("Conversation git clone could not run");
+        }
         if (result.code !== 0) {
             await node_fs_1.promises.rm(workspace.checkout, { recursive: true, force: true }).catch(() => undefined);
-            throw new Error(`git clone failed with exit ${result.code}: ${result.stderr.slice(-500)}`);
+            throw new Error(`git clone failed with exit ${result.code}; check the project's GitHub connection and repository access`);
         }
-        // This machine can read the repository: build the mirror for the next conversation.
         void options.mirrors?.warm(url, env, options.signal);
     }
     await node_fs_1.promises.writeFile(marker, identity, { encoding: "utf8", mode: 0o600 });

package/dist/worktree-guard.cjs

@@ -423,8 +423,8 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
                 ":slash_tmp": "write",
                 [workspaceRoot]: "deny",
             }),
-        [node_path_1.default.resolve(options.worktreePath)]: "write",
-        [node_path_1.default.resolve(options.repositoryPath)]: "write",
+        [node_path_1.default.resolve(options.worktreePath)]: options.readOnly ? "read" : "write",
+        [node_path_1.default.resolve(options.repositoryPath)]: options.readOnly ? "read" : "write",
         [sessionGhConfigDir(options.workDir)]: "read",
     };
     // git runs the credential helper inside the sandbox. Without these grants
@@ -443,7 +443,7 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
     // the runtime-created gitdir explicitly, without reopening session metadata.
     const gitdir = linkedWorktreeGitDir(options.worktreePath, options.repositoryPath);
     if (gitdir)
-        filesystem[gitdir] = "write";
+        filesystem[gitdir] = options.readOnly ? "read" : "write";
     const canonicalWorkspace = canonicalPathWithMissingTail(workspaceRoot);
     const overlapsWorkspace = (root) => {
         const canonicalRoot = canonicalPathWithMissingTail(root);
@@ -469,7 +469,7 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
         // reopen sibling sessions or metadata inside the Navarch workspace.
         if (overlapsWorkspace(resolved))
             continue;
-        filesystem[resolved] = "write";
+        filesystem[resolved] = options.readOnly ? "read" : "write";
     }
     return [
         "--ignore-user-config",
@@ -489,7 +489,7 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
         // Auto-review escalation, while leaving every non-GitHub destination
         // blocked. The profile still constrains filesystem access independently.
         "-c",
-        `permissions.${CODEX_GUARD_PROFILE}.network.enabled=true`,
+        `permissions.${CODEX_GUARD_PROFILE}.network.enabled=${!options.readOnly}`,
         "-c",
         `permissions.${CODEX_GUARD_PROFILE}.network.domains=${tomlInlineTable({
             ...CODEX_GITHUB_NETWORK_DOMAINS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.142",
+  "version": "0.1.144",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",