@sagentlab/navarch-runtime 0.1.18 → 0.1.20

package/README.md

@@ -290,9 +290,16 @@ unchanged across the deployment.
 ## Worktree boundary guard (host mode)
 
 A machine typically runs several sessions concurrently (`NAVARCH_MAX_SESSIONS`),
-each in its own git worktree. The runtime enforces the same boundary for both
+each in its own git worktree. The runtime enforces the same boundary for all
 supported coding agents, using each CLI's native enforcement point:
 
+Every adapter receives an empty, session-owned `GH_CONFIG_DIR` and, when the
+project supplies GitHub credentials, the lease-scoped `GITHUB_TOKEN`. This
+keeps `gh` independent of the operator's selected account and prevents tasks
+from reading unrelated GitHub credentials. Docker already mounts the session
+metadata directory; Gemini's nested host sandbox receives the `gh` directory
+as an explicit read-only mount.
+
 - **Claude Code:** the runtime uses `--permission-mode auto`, which sends
   approval decisions through Claude Code's background safety classifier. It
   does not blanket-preapprove the lease-scoped Navarch MCP tools. A generated
@@ -307,19 +314,17 @@ supported coding agents, using each CLI's native enforcement point:
   Codex's OS sandbox grants read/write access only to the allowed roots and
   denies the surrounding multi-session workspace. Its network policy allows
   GitHub and GitHub-hosted content so authenticated `gh` and git operations
-  required by the task stay inside the sandbox. `gh` reads from an empty,
-  session-owned `GH_CONFIG_DIR` and authenticates with the lease-scoped token,
-  so the operator's GitHub configuration and unrelated credentials remain
-  inaccessible. Other destinations remain blocked and eligible escalations
-  are decided by the automatic reviewer rather than waiting for human input.
+  required by the task stay inside the sandbox. Other destinations remain
+  blocked and eligible escalations are decided by the automatic reviewer
+  rather than waiting for human input.
   `--ignore-user-config` and an untrusted project-config override prevent a
   user or checked-in legacy `sandbox_mode` from silently disabling the
   generated profile; Codex authentication still comes from `CODEX_HOME`, and
   repository instructions such as `AGENTS.md` still load.
 - **Gemini:** the runtime uses Gemini CLI's native sandbox with only the
-  current worktree, shared gitdir, and approved extra roots mounted. The
-  lease MCP config is translated to a read-only temporary settings file;
-  header values remain environment-variable references rather than literals.
+  current worktree, shared gitdir, session `gh` config, and approved extra
+  roots mounted. The `gh` config and lease MCP settings are read-only; header
+  values remain environment-variable references rather than literals.
   Docker-mode sessions disable Gemini's implicit YOLO sandbox to avoid nesting
   it inside Navarch's already isolated session container.
 

package/dist/git-worktree.cjs

@@ -23,13 +23,19 @@ class GitWorktree {
     runner;
     cloneUrl;
     githubToken;
+    taskBranchSuffix;
     constructor(options) {
         const projectKey = safePathSegment(options.projectId);
         const sessionKey = safePathSegment(options.sessionId);
+        const taskKey = safePathSegment(options.taskId);
         this.sessionRoot = node_path_1.default.join(options.workspaceRoot, "sessions", sessionKey);
         this.worktreePath = node_path_1.default.join(this.sessionRoot, "repo");
         this.repositoryPath = node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
-        this.branch = `navarch/${branchSlug(options)}-${sessionKey.toLowerCase().slice(0, 8)}`;
+        // One delivery task owns one remote branch across every retry. A
+        // session-scoped branch lets a failed attempt push useful work, then makes
+        // the retry start from main and open a second PR for the same task.
+        this.taskBranchSuffix = `-${taskKey.toLowerCase()}`;
+        this.branch = `navarch/${branchSlug(options)}${this.taskBranchSuffix}`;
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.cloneUrl = options.cloneUrl;
         this.githubToken = options.githubToken;
@@ -75,7 +81,10 @@ class GitWorktree {
         ], true);
     }
     async addSessionWorktree() {
-        const startRef = await this.resolveStartRef();
+        // A failed session may have pushed before it could report completion. The
+        // next session must resume that task-owned branch, not fork again from the
+        // default branch and create a competing delivery PR.
+        const startRef = (await this.resolveTaskBranchRef()) ?? (await this.resolveStartRef());
         if (!startRef) {
             // Empty remote (no commits yet): there is nothing to base the session on,
             // so bootstrap an orphan branch the session can push as the first commit.
@@ -93,6 +102,22 @@ class GitWorktree {
             startRef,
         ], false);
     }
+    /** Returns the fetched task-owned remote branch when an earlier attempt pushed it. */
+    async resolveTaskBranchRef() {
+        const refs = await this.runGit(["--git-dir", this.repositoryPath, "for-each-ref", "--format=%(refname)", "refs/remotes/origin/navarch"], false);
+        const matches = refs.stdout
+            .split("\n")
+            .map((line) => line.trim())
+            .filter((ref) => ref.endsWith(this.taskBranchSuffix));
+        if (matches.length === 0)
+            return null;
+        if (matches.length > 1) {
+            throw new Error(`Multiple remote branches claim task suffix ${this.taskBranchSuffix}; refusing to fork another delivery branch.`);
+        }
+        const remoteRef = matches[0];
+        this.branch = remoteRef.replace(/^refs\/remotes\/origin\//, "");
+        return remoteRef;
+    }
     /**
      * Resolves the remote-tracking ref new session branches start from, or null
      * when the remote has no branches at all (a freshly provisioned empty repo).
@@ -211,8 +236,8 @@ async function pathExists(value) {
     }
 }
 /**
- * Kebab-case slug for the session branch, derived from the task summary so
- * branch names read like `navarch/fix-login-redirect-a1b2c3d4` instead of a
+ * Kebab-case slug for the task branch, derived from the task summary so
+ * branch names read like `navarch/fix-login-redirect-<task-id>` instead of a
  * UUID mash. Falls back to the task type, then a task-id prefix, when the
  * summary yields nothing. Output contains only [a-z0-9-] with no leading or
  * trailing dash, so it is always a valid git ref component (no `..`, no
@@ -239,7 +264,7 @@ function branchSlug(options) {
 function safePathSegment(value) {
     const safe = value.replace(/[^A-Za-z0-9_.-]/g, "-").replace(/^-+|-+$/g, "");
     if (!safe)
-        throw new Error("Cannot create a git worktree without a valid project/session identifier.");
+        throw new Error("Cannot create a git worktree without a valid identifier.");
     return safe;
 }
 function normalizeCloneUrl(value) {

package/dist/session.cjs

@@ -96,6 +96,9 @@ async function runSession(deps, claimed, sessionId) {
         };
     }
     const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail);
+    const ghConfigDir = (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir);
+    await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
+    sessionEnv.GH_CONFIG_DIR = ghConfigDir;
     const cloneUrl = bundle.repository?.clone_url ??
         (task.repo ? `https://github.com/${task.repo.replace(/\.git$/, "")}.git` : null);
     if (!cloneUrl) {
@@ -242,9 +245,6 @@ async function runSession(deps, claimed, sessionId) {
             }
         }
         else if (runtime === "codex") {
-            const ghConfigDir = (0, worktree_guard_cjs_1.codexGhConfigDir)(workDir);
-            await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
-            sessionEnv.GH_CONFIG_DIR = ghConfigDir;
             codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
                 workDir,
                 worktreePath: gitWorktree.worktreePath,

package/dist/worktree-guard.cjs

@@ -7,14 +7,14 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
-exports.codexGhConfigDir = codexGhConfigDir;
+exports.sessionGhConfigDir = sessionGhConfigDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const CODEX_GUARD_PROFILE = "navarch-worktree";
-const CODEX_GH_CONFIG_DIRNAME = "gh-config";
+const SESSION_GH_CONFIG_DIRNAME = "gh-config";
 const CODEX_GITHUB_NETWORK_DOMAINS = {
     "**.github.com": "allow",
     "**.githubusercontent.com": "allow",
@@ -129,15 +129,15 @@ function codexToolReadRoots(env = process.env) {
     ];
 }
 /**
- * Isolated gh configuration root for one Codex session.
+ * Isolated gh configuration root for one coding-agent session.
  *
  * `gh` reads its config file before it considers `GITHUB_TOKEN`. Pointing it
  * at this empty, session-owned directory lets the CLI use the lease token
  * without granting the agent read access to the operator's ~/.config/gh,
  * which may contain unrelated account credentials.
  */
-function codexGhConfigDir(workDir) {
-    return node_path_1.default.join(workDir, CODEX_GH_CONFIG_DIRNAME);
+function sessionGhConfigDir(workDir) {
+    return node_path_1.default.join(workDir, SESSION_GH_CONFIG_DIRNAME);
 }
 /**
  * Builds one-off Codex permission-profile arguments for a host session.
@@ -161,7 +161,7 @@ function codexWorktreeGuardArgs(options) {
         [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
         [node_path_1.default.resolve(options.worktreePath)]: "write",
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
-        [codexGhConfigDir(options.workDir)]: "read",
+        [sessionGhConfigDir(options.workDir)]: "read",
     };
     for (const root of codexToolReadRoots()) {
         const resolved = node_path_1.default.resolve(root);
@@ -204,8 +204,9 @@ function codexWorktreeGuardArgs(options) {
 }
 /**
  * Mounts only the current session roots into Gemini CLI's native sandbox.
- * Gemini mounts cwd itself; explicit same-path mounts keep the shared gitdir
- * and approved external roots reachable without exposing sibling sessions.
+ * Gemini mounts cwd itself; explicit same-path mounts keep the shared gitdir,
+ * isolated gh config, and approved external roots reachable without exposing
+ * sibling sessions.
  */
 function geminiSandboxMounts(options) {
     const workspaceRoot = node_path_1.default.resolve(options.workspaceRoot);
@@ -215,7 +216,9 @@ function geminiSandboxMounts(options) {
         if (!isPathInside(resolved, workspaceRoot))
             roots.push(resolved);
     }
-    return [...new Set(roots.map((root) => node_path_1.default.resolve(root)))].map((root) => `${root}:${root}:rw`);
+    const writableMounts = [...new Set(roots.map((root) => node_path_1.default.resolve(root)))].map((root) => `${root}:${root}:rw`);
+    const ghConfigDir = sessionGhConfigDir(options.workDir);
+    return [...writableMounts, `${ghConfigDir}:${ghConfigDir}:ro`];
 }
 function isPathInside(candidate, root) {
     const relative = node_path_1.default.relative(root, candidate);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",