@sagentlab/navarch-runtime 0.1.17 → 0.1.18

package/README.md

@@ -264,7 +264,7 @@ unchanged across the deployment.
 | `NAVARCH_MAX_SESSIONS` | `5` | Local concurrent-session capacity cap — see `src/capacity.cts`. |
 | `NAVARCH_CAPABILITIES` | `shell,browser-use` (`docker-sandbox,shell` in Docker mode) | Comma list reported at heartbeat/claim time. Docker mode does not advertise browser use until the configured image provides it. |
 | `NAVARCH_OWNER_ZONE` | `sagentlab` | `sagentlab` or `customer-<slug>-premises` (project-plan.md §3.11). |
-| `NAVARCH_POLL_INTERVAL_MS` | `5000` | Claim-loop poll interval. |
+| `NAVARCH_POLL_INTERVAL_MS` | `30000` | Claim-loop poll interval. |
 | `NAVARCH_HEARTBEAT_INTERVAL_MS` | `60000` | Machine-level heartbeat interval. |
 | `NAVARCH_LEASE_HEARTBEAT_INTERVAL_MS` | `300000` | Per-lease heartbeat interval; must stay well under the 15-minute lease TTL (schema-design.md §4). |
 | `NAVARCH_SESSION_TIMEOUT_MS` | `2700000` (45 min) | Hard kill timeout for a single session. |
@@ -305,7 +305,12 @@ supported coding agents, using each CLI's native enforcement point:
 - **Codex:** the runtime passes a one-off native permission profile with
   `approval_policy="on-request"` and `approvals_reviewer="auto_review"`.
   Codex's OS sandbox grants read/write access only to the allowed roots and
-  denies the surrounding multi-session workspace, while eligible escalations
+  denies the surrounding multi-session workspace. Its network policy allows
+  GitHub and GitHub-hosted content so authenticated `gh` and git operations
+  required by the task stay inside the sandbox. `gh` reads from an empty,
+  session-owned `GH_CONFIG_DIR` and authenticates with the lease-scoped token,
+  so the operator's GitHub configuration and unrelated credentials remain
+  inaccessible. Other destinations remain blocked and eligible escalations
   are decided by the automatic reviewer rather than waiting for human input.
   `--ignore-user-config` and an untrusted project-config override prevent a
   user or checked-in legacy `sandbox_mode` from silently disabling the
@@ -330,8 +335,10 @@ The resulting boundary is:
   system prefixes.
 - The **rest of the workspace root** — sibling sessions' worktrees, other
   projects' bare repos, and the session's own metadata dir (lease-scoped MCP
-  config, the guard files themselves) — is denied outright, so an agent can
-  neither read another agent's checkout nor rewrite its own guard policy.
+  config, the guard files themselves) — is denied outright. The only metadata
+  exception is the empty, read-only `gh` config directory described above, so
+  an agent can neither read another agent's checkout nor rewrite its own guard
+  policy.
 
 The Claude hook is a strong guardrail rather than a hard security boundary
 because shell paths are screened lexically. Codex's permission profile is

package/dist/config.cjs

@@ -61,7 +61,7 @@ function loadRuntimeConfig(env = process.env) {
         maxSessions: envInt(env, "NAVARCH_MAX_SESSIONS", 5),
         capabilities: envList(env, "NAVARCH_CAPABILITIES", defaultCapabilities),
         ownerZone: env.NAVARCH_OWNER_ZONE ?? "sagentlab",
-        pollIntervalMs: envInt(env, "NAVARCH_POLL_INTERVAL_MS", 5000),
+        pollIntervalMs: envInt(env, "NAVARCH_POLL_INTERVAL_MS", 30_000),
         machineHeartbeatIntervalMs: envInt(env, "NAVARCH_HEARTBEAT_INTERVAL_MS", 60_000),
         // leases.expires_at = claimed_at + 15 min (schema-design.md §4) — default renewal
         // interval must stay comfortably under that TTL.

package/dist/session.cjs

@@ -95,6 +95,7 @@ async function runSession(deps, claimed, sessionId) {
             leaseId,
         };
     }
+    const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail);
     const cloneUrl = bundle.repository?.clone_url ??
         (task.repo ? `https://github.com/${task.repo.replace(/\.git$/, "")}.git` : null);
     if (!cloneUrl) {
@@ -241,6 +242,9 @@ async function runSession(deps, claimed, sessionId) {
             }
         }
         else if (runtime === "codex") {
+            const ghConfigDir = (0, worktree_guard_cjs_1.codexGhConfigDir)(workDir);
+            await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
+            sessionEnv.GH_CONFIG_DIR = ghConfigDir;
             codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
                 workDir,
                 worktreePath: gitWorktree.worktreePath,
@@ -266,7 +270,7 @@ async function runSession(deps, claimed, sessionId) {
         await gitWorktree.prepare();
         if (sandbox) {
             await sandbox.create();
-            await sandbox.injectEnv(toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail));
+            await sandbox.injectEnv(sessionEnv);
         }
         // The control plane returns the agent type selected for this worker.
         // Any agent type may run any task; capabilities remain the task-level gate.
@@ -300,7 +304,7 @@ async function runSession(deps, claimed, sessionId) {
                 model: execution.model,
                 reasoningEffort: execution.reasoning_effort,
                 timeoutMs: config.sessionTimeoutMs,
-                env: toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail),
+                env: sessionEnv,
                 settingsPath: claudeSettingsPath,
                 codexGuardArgs,
                 geminiSandboxMounts: geminiGuardMounts,
@@ -468,7 +472,10 @@ async function runSession(deps, claimed, sessionId) {
         // every other body we surface) so a 4xx/5xx completion stays diagnosable.
         const crashDetail = (0, redact_cjs_1.redactText)(describeCompletionError(err), knownSecrets);
         log.error(`session ${leaseId} threw before completing: ${crashDetail}`);
-        const failureSummary = (0, redact_cjs_1.redactText)(`Session crashed: ${String(err)}`, knownSecrets);
+        // Send the same bounded, redacted detail to the control plane that we log
+        // locally. NavarchApiError.message contains only the HTTP status line; its
+        // response body carries the actionable server error shown in session UI.
+        const failureSummary = `Session crashed: ${crashDetail}`;
         await api
             .completeLease(leaseId, {
             status: "failed",

package/dist/worktree-guard.cjs

@@ -7,12 +7,18 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
+exports.codexGhConfigDir = codexGhConfigDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const CODEX_GUARD_PROFILE = "navarch-worktree";
+const CODEX_GH_CONFIG_DIRNAME = "gh-config";
+const CODEX_GITHUB_NETWORK_DOMAINS = {
+    "**.github.com": "allow",
+    "**.githubusercontent.com": "allow",
+};
 const CLAUDE_USER_SETTINGS_FILENAME = "settings.json";
 /**
  * Tools the hook screens. Everything else — the lease-scoped Navarch MCP
@@ -122,6 +128,17 @@ function codexToolReadRoots(env = process.env) {
         node_path_1.default.join(homeDir, ".cache", "ms-playwright"),
     ];
 }
+/**
+ * Isolated gh configuration root for one Codex session.
+ *
+ * `gh` reads its config file before it considers `GITHUB_TOKEN`. Pointing it
+ * at this empty, session-owned directory lets the CLI use the lease token
+ * without granting the agent read access to the operator's ~/.config/gh,
+ * which may contain unrelated account credentials.
+ */
+function codexGhConfigDir(workDir) {
+    return node_path_1.default.join(workDir, CODEX_GH_CONFIG_DIRNAME);
+}
 /**
  * Builds one-off Codex permission-profile arguments for a host session.
  *
@@ -144,6 +161,7 @@ function codexWorktreeGuardArgs(options) {
         [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
         [node_path_1.default.resolve(options.worktreePath)]: "write",
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
+        [codexGhConfigDir(options.workDir)]: "read",
     };
     for (const root of codexToolReadRoots()) {
         const resolved = node_path_1.default.resolve(root);
@@ -173,10 +191,15 @@ function codexWorktreeGuardArgs(options) {
         `default_permissions=${tomlString(CODEX_GUARD_PROFILE)}`,
         "-c",
         `permissions.${CODEX_GUARD_PROFILE}.filesystem=${tomlInlineTable(filesystem)}`,
-        // Navarch coding tasks must be able to fetch dependencies and push their
-        // branch. The profile still constrains filesystem access independently.
+        // A network-enabled permission profile still blocks every destination
+        // until it has at least one allow rule. Keep routine authenticated GitHub
+        // CLI and git traffic inside the sandbox so it does not become an
+        // Auto-review escalation, while leaving every non-GitHub destination
+        // blocked. The profile still constrains filesystem access independently.
         "-c",
         `permissions.${CODEX_GUARD_PROFILE}.network.enabled=true`,
+        "-c",
+        `permissions.${CODEX_GUARD_PROFILE}.network.domains=${tomlInlineTable(CODEX_GITHUB_NETWORK_DOMAINS)}`,
     ];
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",