@sagentlab/navarch-runtime 0.1.19 → 0.1.21

package/README.md

@@ -290,9 +290,16 @@ unchanged across the deployment.
 ## Worktree boundary guard (host mode)
 
 A machine typically runs several sessions concurrently (`NAVARCH_MAX_SESSIONS`),
-each in its own git worktree. The runtime enforces the same boundary for both
+each in its own git worktree. The runtime enforces the same boundary for all
 supported coding agents, using each CLI's native enforcement point:
 
+Every adapter receives an empty, session-owned `GH_CONFIG_DIR` and, when the
+project supplies GitHub credentials, the lease-scoped `GITHUB_TOKEN`. This
+keeps `gh` independent of the operator's selected account and prevents tasks
+from reading unrelated GitHub credentials. Docker already mounts the session
+metadata directory; Gemini's nested host sandbox receives the `gh` directory
+as an explicit read-only mount.
+
 - **Claude Code:** the runtime uses `--permission-mode auto`, which sends
   approval decisions through Claude Code's background safety classifier. It
   does not blanket-preapprove the lease-scoped Navarch MCP tools. A generated
@@ -307,19 +314,17 @@ supported coding agents, using each CLI's native enforcement point:
   Codex's OS sandbox grants read/write access only to the allowed roots and
   denies the surrounding multi-session workspace. Its network policy allows
   GitHub and GitHub-hosted content so authenticated `gh` and git operations
-  required by the task stay inside the sandbox. `gh` reads from an empty,
-  session-owned `GH_CONFIG_DIR` and authenticates with the lease-scoped token,
-  so the operator's GitHub configuration and unrelated credentials remain
-  inaccessible. Other destinations remain blocked and eligible escalations
-  are decided by the automatic reviewer rather than waiting for human input.
+  required by the task stay inside the sandbox. Other destinations remain
+  blocked and eligible escalations are decided by the automatic reviewer
+  rather than waiting for human input.
   `--ignore-user-config` and an untrusted project-config override prevent a
   user or checked-in legacy `sandbox_mode` from silently disabling the
   generated profile; Codex authentication still comes from `CODEX_HOME`, and
   repository instructions such as `AGENTS.md` still load.
 - **Gemini:** the runtime uses Gemini CLI's native sandbox with only the
-  current worktree, shared gitdir, and approved extra roots mounted. The
-  lease MCP config is translated to a read-only temporary settings file;
-  header values remain environment-variable references rather than literals.
+  current worktree, shared gitdir, session `gh` config, and approved extra
+  roots mounted. The `gh` config and lease MCP settings are read-only; header
+  values remain environment-variable references rather than literals.
   Docker-mode sessions disable Gemini's implicit YOLO sandbox to avoid nesting
   it inside Navarch's already isolated session container.
 

package/dist/adapters/codex.cjs

@@ -6,6 +6,7 @@ exports.hasExplicitPermissionPolicy = hasExplicitPermissionPolicy;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
+const codex_pricing_cjs_1 = require("../codex-pricing.cjs");
 /**
  * Headless OpenAI Codex CLI adapter — the Codex sibling of claude.cts's
  * `runClaudeCodeAdapter`, implementing the same AgentAdapter interface
@@ -63,7 +64,7 @@ async function runCodexAdapter(options) {
     const raw = runOptions.dockerExec
         ? await runViaDocker(runOptions, args)
         : await runOnHost(runOptions, args);
-    return attachUsage(raw);
+    return attachUsage(raw, options.model);
 }
 /** Operator policy wins over Navarch's generated host-mode profile. */
 function hasExplicitPermissionPolicy(args) {
@@ -139,13 +140,15 @@ function safeEnvSegment(value) {
 /**
  * Parses stdout for `codex exec --json` usage/final-message events and folds
  * them onto the raw result. Codex currently reports token counts but no USD
- * cost, so costUsd remains absent unless the stream explicitly provides one.
+ * cost, so known models receive a standard-tier API-equivalent estimate. An
+ * explicit cost from a compatible future event always takes precedence.
  */
-function attachUsage(result) {
+function attachUsage(result, model) {
     const events = (0, exit_conditions_cjs_1.parseCodexJsonEvents)(result.stdout);
     if (events.length === 0)
         return result;
     const usage = (0, exit_conditions_cjs_1.extractUsageFromCodexEvents)(events);
+    const costUsd = usage.costUsd ?? (0, codex_pricing_cjs_1.estimateCodexCostUsd)(events, model);
     const reportText = (0, exit_conditions_cjs_1.extractFinalMessageFromCodexEvents)(events) ?? undefined;
     return {
         ...result,
@@ -153,7 +156,7 @@ function attachUsage(result) {
         // measured zero — leave the fields unset so aggregation skips them.
         ...(usage.tokensIn !== undefined ? { tokensIn: usage.tokensIn } : {}),
         ...(usage.tokensOut !== undefined ? { tokensOut: usage.tokensOut } : {}),
-        ...(usage.costUsd !== undefined ? { costUsd: usage.costUsd } : {}),
+        ...(costUsd !== undefined ? { costUsd } : {}),
         ...(reportText !== undefined ? { reportText } : {}),
     };
 }

package/dist/codex-pricing.cjs

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.estimateCodexCostUsd = estimateCodexCostUsd;
+/**
+ * Standard-tier USD prices per 1M tokens. Codex's JSONL stream reports usage
+ * but not dollars, so the runtime needs a local price snapshot to turn that
+ * usage into project spend. Keep this deliberately limited to models Navarch
+ * offers rather than silently applying the wrong price to custom/gateway ids.
+ *
+ * Source (checked 2026-08-05): https://developers.openai.com/api/docs/pricing
+ */
+const CODEX_RATES = {
+    "gpt-5.6-sol": {
+        input: 5,
+        cachedInput: 0.5,
+        cacheWrite: 6.25,
+        output: 30,
+    },
+};
+function nonnegative(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
+}
+function priceUsage(usage, rates) {
+    const input = nonnegative(usage.input);
+    // Cached reads and cache writes are components of input_tokens, not extra
+    // tokens. Clamp malformed/provider-newer detail fields to the reported total
+    // so an odd event cannot produce negative uncached input or inflated spend.
+    const cachedInput = Math.min(input, nonnegative(usage.cachedInput));
+    const cacheWrite = Math.min(input - cachedInput, nonnegative(usage.cacheWrite));
+    const uncachedInput = input - cachedInput - cacheWrite;
+    const output = nonnegative(usage.output);
+    return (uncachedInput * rates.input +
+        cachedInput * rates.cachedInput +
+        cacheWrite * rates.cacheWrite +
+        output * rates.output) / 1_000_000;
+}
+/**
+ * Estimate standard-tier API-equivalent USD cost for a Codex JSONL run.
+ * Verified turn.completed events are per-turn and must be summed; legacy
+ * token_count envelopes are cumulative, so only their final total is priced.
+ * Returns undefined for unknown models or when no usage event was observed.
+ */
+function estimateCodexCostUsd(events, model) {
+    if (!model)
+        return undefined;
+    const rates = CODEX_RATES[model];
+    if (!rates)
+        return undefined;
+    let sawTurnUsage = false;
+    let turnCost = 0;
+    let legacyUsage;
+    for (const event of events) {
+        if (event.type === "turn.completed" && event.usage) {
+            sawTurnUsage = true;
+            turnCost += priceUsage({
+                input: event.usage.input_tokens,
+                cachedInput: event.usage.cached_input_tokens,
+                cacheWrite: event.usage.cache_write_input_tokens,
+                output: event.usage.output_tokens,
+            }, rates);
+        }
+        if (event.msg?.type === "token_count") {
+            const usage = event.msg.info?.total_token_usage;
+            legacyUsage = usage
+                ? {
+                    input: usage.input_tokens,
+                    cachedInput: usage.cached_input_tokens,
+                    cacheWrite: usage.cache_write_input_tokens,
+                    output: usage.output_tokens,
+                }
+                : {
+                    // In the oldest flat envelope cached_input_tokens was additional
+                    // to input_tokens; normalize it to the newer inclusive total.
+                    input: nonnegative(event.msg.input_tokens) + nonnegative(event.msg.cached_input_tokens),
+                    cachedInput: event.msg.cached_input_tokens,
+                    output: event.msg.output_tokens,
+                };
+        }
+        if (event.type === "event_msg" && event.payload?.type === "token_count") {
+            const usage = event.payload.info?.total_token_usage;
+            if (usage) {
+                legacyUsage = {
+                    input: usage.input_tokens,
+                    cachedInput: usage.cached_input_tokens,
+                    cacheWrite: usage.cache_write_input_tokens,
+                    output: usage.output_tokens,
+                };
+            }
+        }
+    }
+    if (sawTurnUsage)
+        return turnCost;
+    return legacyUsage ? priceUsage(legacyUsage, rates) : undefined;
+}

package/dist/git-worktree.cjs

@@ -24,6 +24,8 @@ class GitWorktree {
     cloneUrl;
     githubToken;
     taskBranchSuffix;
+    legacyTaskBranchSuffix;
+    taskOwnershipTrailer;
     constructor(options) {
         const projectKey = safePathSegment(options.projectId);
         const sessionKey = safePathSegment(options.sessionId);
@@ -34,7 +36,10 @@ class GitWorktree {
         // One delivery task owns one remote branch across every retry. A
         // session-scoped branch lets a failed attempt push useful work, then makes
         // the retry start from main and open a second PR for the same task.
-        this.taskBranchSuffix = `-${taskKey.toLowerCase()}`;
+        const normalizedTaskId = taskKey.toLowerCase();
+        this.taskBranchSuffix = `-${normalizedTaskId.slice(0, 8)}`;
+        this.legacyTaskBranchSuffix = `-${normalizedTaskId}`;
+        this.taskOwnershipTrailer = `Navarch-Task-ID: ${normalizedTaskId}`;
         this.branch = `navarch/${branchSlug(options)}${this.taskBranchSuffix}`;
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.cloneUrl = options.cloneUrl;
@@ -84,11 +89,13 @@ class GitWorktree {
         // A failed session may have pushed before it could report completion. The
         // next session must resume that task-owned branch, not fork again from the
         // default branch and create a competing delivery PR.
-        const startRef = (await this.resolveTaskBranchRef()) ?? (await this.resolveStartRef());
+        const taskRef = await this.resolveTaskBranchRef();
+        const startRef = taskRef ?? (await this.resolveStartRef());
         if (!startRef) {
             // Empty remote (no commits yet): there is nothing to base the session on,
             // so bootstrap an orphan branch the session can push as the first commit.
             await this.addOrphanWorktree();
+            await this.createTaskOwnershipCommit();
             return;
         }
         await this.runGit([
@@ -101,16 +108,32 @@ class GitWorktree {
             this.worktreePath,
             startRef,
         ], false);
+        if (!taskRef)
+            await this.createTaskOwnershipCommit();
     }
     /** Returns the fetched task-owned remote branch when an earlier attempt pushed it. */
     async resolveTaskBranchRef() {
         const refs = await this.runGit(["--git-dir", this.repositoryPath, "for-each-ref", "--format=%(refname)", "refs/remotes/origin/navarch"], false);
-        const matches = refs.stdout
+        const suffixMatches = refs.stdout
             .split("\n")
             .map((line) => line.trim())
             .filter((ref) => ref.endsWith(this.taskBranchSuffix));
-        if (matches.length === 0)
+        const legacyMatches = refs.stdout
+            .split("\n")
+            .map((line) => line.trim())
+            .filter((ref) => ref.endsWith(this.legacyTaskBranchSuffix));
+        const shortMatches = suffixMatches.filter((ref) => !legacyMatches.includes(ref));
+        const ownedShortMatches = (await Promise.all(shortMatches.map(async (ref) => ({ ref, owned: await this.hasTaskOwnershipMarker(ref) }))))
+            .filter(({ owned }) => owned)
+            .map(({ ref }) => ref);
+        const matches = [...ownedShortMatches, ...legacyMatches];
+        if (matches.length === 0) {
+            if (shortMatches.length > 0) {
+                throw new Error(`Remote branch ${shortMatches[0]} shares task suffix ${this.taskBranchSuffix} but does not ` +
+                    `contain ownership marker ${this.taskOwnershipTrailer}; refusing to resume or fork.`);
+            }
             return null;
+        }
         if (matches.length > 1) {
             throw new Error(`Multiple remote branches claim task suffix ${this.taskBranchSuffix}; refusing to fork another delivery branch.`);
         }
@@ -118,6 +141,38 @@ class GitWorktree {
         this.branch = remoteRef.replace(/^refs\/remotes\/origin\//, "");
         return remoteRef;
     }
+    /** Short branch names are ambiguous without a full task-ID marker in their history. */
+    async hasTaskOwnershipMarker(ref) {
+        const log = await this.runGit([
+            "--git-dir",
+            this.repositoryPath,
+            "log",
+            "--format=%B",
+            "--fixed-strings",
+            `--grep=${this.taskOwnershipTrailer}`,
+            ref,
+        ], false);
+        return log.stdout
+            .split("\n")
+            .some((line) => line.trim() === this.taskOwnershipTrailer);
+    }
+    /** Records full task ownership without lengthening the human-facing branch name. */
+    async createTaskOwnershipCommit() {
+        await this.runGit([
+            "-C",
+            this.worktreePath,
+            "-c",
+            "user.name=Navarch",
+            "-c",
+            "user.email=runtime@navarch.local",
+            "commit",
+            "--allow-empty",
+            "-m",
+            "chore(navarch): claim task branch",
+            "-m",
+            this.taskOwnershipTrailer,
+        ], false);
+    }
     /**
      * Resolves the remote-tracking ref new session branches start from, or null
      * when the remote has no branches at all (a freshly provisioned empty repo).

package/dist/session.cjs

@@ -96,6 +96,9 @@ async function runSession(deps, claimed, sessionId) {
         };
     }
     const sessionEnv = toEnvMap(secrets, gitCredentialRefresh, config.gitAuthorName, config.gitAuthorEmail);
+    const ghConfigDir = (0, worktree_guard_cjs_1.sessionGhConfigDir)(workDir);
+    await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
+    sessionEnv.GH_CONFIG_DIR = ghConfigDir;
     const cloneUrl = bundle.repository?.clone_url ??
         (task.repo ? `https://github.com/${task.repo.replace(/\.git$/, "")}.git` : null);
     if (!cloneUrl) {
@@ -242,9 +245,6 @@ async function runSession(deps, claimed, sessionId) {
             }
         }
         else if (runtime === "codex") {
-            const ghConfigDir = (0, worktree_guard_cjs_1.codexGhConfigDir)(workDir);
-            await node_fs_1.promises.mkdir(ghConfigDir, { recursive: true, mode: 0o700 });
-            sessionEnv.GH_CONFIG_DIR = ghConfigDir;
             codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
                 workDir,
                 worktreePath: gitWorktree.worktreePath,

package/dist/worktree-guard.cjs

@@ -7,14 +7,14 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
-exports.codexGhConfigDir = codexGhConfigDir;
+exports.sessionGhConfigDir = sessionGhConfigDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
 const CODEX_GUARD_PROFILE = "navarch-worktree";
-const CODEX_GH_CONFIG_DIRNAME = "gh-config";
+const SESSION_GH_CONFIG_DIRNAME = "gh-config";
 const CODEX_GITHUB_NETWORK_DOMAINS = {
     "**.github.com": "allow",
     "**.githubusercontent.com": "allow",
@@ -129,15 +129,15 @@ function codexToolReadRoots(env = process.env) {
     ];
 }
 /**
- * Isolated gh configuration root for one Codex session.
+ * Isolated gh configuration root for one coding-agent session.
  *
  * `gh` reads its config file before it considers `GITHUB_TOKEN`. Pointing it
  * at this empty, session-owned directory lets the CLI use the lease token
  * without granting the agent read access to the operator's ~/.config/gh,
  * which may contain unrelated account credentials.
  */
-function codexGhConfigDir(workDir) {
-    return node_path_1.default.join(workDir, CODEX_GH_CONFIG_DIRNAME);
+function sessionGhConfigDir(workDir) {
+    return node_path_1.default.join(workDir, SESSION_GH_CONFIG_DIRNAME);
 }
 /**
  * Builds one-off Codex permission-profile arguments for a host session.
@@ -161,7 +161,7 @@ function codexWorktreeGuardArgs(options) {
         [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
         [node_path_1.default.resolve(options.worktreePath)]: "write",
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
-        [codexGhConfigDir(options.workDir)]: "read",
+        [sessionGhConfigDir(options.workDir)]: "read",
     };
     for (const root of codexToolReadRoots()) {
         const resolved = node_path_1.default.resolve(root);
@@ -204,8 +204,9 @@ function codexWorktreeGuardArgs(options) {
 }
 /**
  * Mounts only the current session roots into Gemini CLI's native sandbox.
- * Gemini mounts cwd itself; explicit same-path mounts keep the shared gitdir
- * and approved external roots reachable without exposing sibling sessions.
+ * Gemini mounts cwd itself; explicit same-path mounts keep the shared gitdir,
+ * isolated gh config, and approved external roots reachable without exposing
+ * sibling sessions.
  */
 function geminiSandboxMounts(options) {
     const workspaceRoot = node_path_1.default.resolve(options.workspaceRoot);
@@ -215,7 +216,9 @@ function geminiSandboxMounts(options) {
         if (!isPathInside(resolved, workspaceRoot))
             roots.push(resolved);
     }
-    return [...new Set(roots.map((root) => node_path_1.default.resolve(root)))].map((root) => `${root}:${root}:rw`);
+    const writableMounts = [...new Set(roots.map((root) => node_path_1.default.resolve(root)))].map((root) => `${root}:${root}:rw`);
+    const ghConfigDir = sessionGhConfigDir(options.workDir);
+    return [...writableMounts, `${ghConfigDir}:${ghConfigDir}:ro`];
 }
 function isPathInside(candidate, root) {
     const relative = node_path_1.default.relative(root, candidate);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",