@sagentlab/navarch-runtime 0.1.19 → 0.1.20

package/README.md

@@ -290,9 +290,16 @@ unchanged across the deployment.
 ## Worktree boundary guard (host mode)
 
 A machine typically runs several sessions concurrently (`NAVARCH_MAX_SESSIONS`),
-each in its own git worktree. The runtime enforces the same boundary for both
+each in its own git worktree. The runtime enforces the same boundary for all
 supported coding agents, using each CLI's native enforcement point:
 
+Every adapter receives an empty, session-owned `GH_CONFIG_DIR` and, when the
+project supplies GitHub credentials, the lease-scoped `GITHUB_TOKEN`. This
+keeps `gh` independent of the operator's selected account and prevents tasks
+from reading unrelated GitHub credentials. Docker already mounts the session
+metadata directory; Gemini's nested host sandbox receives the `gh` directory
+as an explicit read-only mount.
+
 - **Claude Code:** the runtime uses `--permission-mode auto`, which sends
   approval decisions through Claude Code's background safety classifier. It
   does not blanket-preapprove the lease-scoped Navarch MCP tools. A generated
@@ -307,19 +314,17 @@ supported coding agents, using each CLI's native enforcement point:
   Codex's OS sandbox grants read/write access only to the allowed roots and
   denies the surrounding multi-session workspace. Its network policy allows
   GitHub and GitHub-hosted content so authenticated `gh` and git operations
-  required by the task stay inside the sandbox. `gh` reads from an empty,
-  session-owned `GH_CONFIG_DIR` and authenticates with the lease-scoped token,
-  so the operator's GitHub configuration and unrelated credentials remain
-  inaccessible. Other destinations remain blocked and eligible escalations
-  are decided by the automatic reviewer rather than waiting for human input.
+  required by the task stay inside the sandbox. Other destinations remain
+  blocked and eligible escalations are decided by the automatic reviewer
+  rather than waiting for human input.
   `--ignore-user-config` and an untrusted project-config override prevent a
   user or checked-in legacy `sandbox_mode` from silently disabling the
   generated profile; Codex authentication still comes from `CODEX_HOME`, and
   repository instructions such as `AGENTS.md` still load.
 - **Gemini:** the runtime uses Gemini CLI's native sandbox with only the
-  current worktree, shared gitdir, and approved extra roots mounted. The
-  lease MCP config is translated to a read-only temporary settings file;
-  header values remain environment-variable references rather than literals.
+  current worktree, shared gitdir, session `gh` config, and approved extra
+  roots mounted. The `gh` config and lease MCP settings are read-only; header
+  values remain environment-variable references rather than literals.
   Docker-mode sessions disable Gemini's implicit YOLO sandbox to avoid nesting
   it inside Navarch's already isolated session container.
 

package/dist/session.cjs

@@ -96,6 +96,9 @@ async function runSession(deps, claimed, sessionId) {
         };
     }
     const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail);
+    const ghConfigDir = (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir);
+    await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
+    sessionEnv.GH_CONFIG_DIR = ghConfigDir;
     const cloneUrl = bundle.repository?.clone_url ??
         (task.repo ? `https://github.com/${task.repo.replace(/\.git$/, "")}.git` : null);
     if (!cloneUrl) {
@@ -242,9 +245,6 @@ async function runSession(deps, claimed, sessionId) {
             }
         }
         else if (runtime === "codex") {
-            const ghConfigDir = (0, worktree_guard_cjs_1.codexGhConfigDir)(workDir);
-            await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
-            sessionEnv.GH_CONFIG_DIR = ghConfigDir;
             codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
                 workDir,
                 worktreePath: gitWorktree.worktreePath,

package/dist/worktree-guard.cjs

@@ -7,14 +7,14 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
-exports.codexGhConfigDir = codexGhConfigDir;
+exports.sessionGhConfigDir = sessionGhConfigDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const CODEX_GUARD_PROFILE = "navarch-worktree";
-const CODEX_GH_CONFIG_DIRNAME = "gh-config";
+const SESSION_GH_CONFIG_DIRNAME = "gh-config";
 const CODEX_GITHUB_NETWORK_DOMAINS = {
     "**.github.com": "allow",
     "**.githubusercontent.com": "allow",
@@ -129,15 +129,15 @@ function codexToolReadRoots(env = process.env) {
     ];
 }
 /**
- * Isolated gh configuration root for one Codex session.
+ * Isolated gh configuration root for one coding-agent session.
  *
  * `gh` reads its config file before it considers `GITHUB_TOKEN`. Pointing it
  * at this empty, session-owned directory lets the CLI use the lease token
  * without granting the agent read access to the operator's ~/.config/gh,
  * which may contain unrelated account credentials.
  */
-function codexGhConfigDir(workDir) {
-    return node_path_1.default.join(workDir, CODEX_GH_CONFIG_DIRNAME);
+function sessionGhConfigDir(workDir) {
+    return node_path_1.default.join(workDir, SESSION_GH_CONFIG_DIRNAME);
 }
 /**
  * Builds one-off Codex permission-profile arguments for a host session.
@@ -161,7 +161,7 @@ function codexWorktreeGuardArgs(options) {
         [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
         [node_path_1.default.resolve(options.worktreePath)]: "write",
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
-        [codexGhConfigDir(options.workDir)]: "read",
+        [sessionGhConfigDir(options.workDir)]: "read",
     };
     for (const root of codexToolReadRoots()) {
         const resolved = node_path_1.default.resolve(root);
@@ -204,8 +204,9 @@ function codexWorktreeGuardArgs(options) {
 }
 /**
  * Mounts only the current session roots into Gemini CLI's native sandbox.
- * Gemini mounts cwd itself; explicit same-path mounts keep the shared gitdir
- * and approved external roots reachable without exposing sibling sessions.
+ * Gemini mounts cwd itself; explicit same-path mounts keep the shared gitdir,
+ * isolated gh config, and approved external roots reachable without exposing
+ * sibling sessions.
  */
 function geminiSandboxMounts(options) {
     const workspaceRoot = node_path_1.default.resolve(options.workspaceRoot);
@@ -215,7 +216,9 @@ function geminiSandboxMounts(options) {
         if (!isPathInside(resolved, workspaceRoot))
             roots.push(resolved);
     }
-    return [...new Set(roots.map((root) => node_path_1.default.resolve(root)))].map((root) => `${root}:${root}:rw`);
+    const writableMounts = [...new Set(roots.map((root) => node_path_1.default.resolve(root)))].map((root) => `${root}:${root}:rw`);
+    const ghConfigDir = sessionGhConfigDir(options.workDir);
+    return [...writableMounts, `${ghConfigDir}:${ghConfigDir}:ro`];
 }
 function isPathInside(candidate, root) {
     const relative = node_path_1.default.relative(root, candidate);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",