@sagentlab/navarch-runtime 0.1.20 → 0.1.22

package/dist/adapters/codex.cjs

@@ -6,6 +6,7 @@ exports.hasExplicitPermissionPolicy = hasExplicitPermissionPolicy;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
+const codex_pricing_cjs_1 = require("../codex-pricing.cjs");
 /**
  * Headless OpenAI Codex CLI adapter — the Codex sibling of claude.cts's
  * `runClaudeCodeAdapter`, implementing the same AgentAdapter interface
@@ -63,7 +64,7 @@ async function runCodexAdapter(options) {
     const raw = runOptions.dockerExec
         ? await runViaDocker(runOptions, args)
         : await runOnHost(runOptions, args);
-    return attachUsage(raw);
+    return attachUsage(raw, options.model);
 }
 /** Operator policy wins over Navarch's generated host-mode profile. */
 function hasExplicitPermissionPolicy(args) {
@@ -139,13 +140,15 @@ function safeEnvSegment(value) {
 /**
  * Parses stdout for `codex exec --json` usage/final-message events and folds
  * them onto the raw result. Codex currently reports token counts but no USD
- * cost, so costUsd remains absent unless the stream explicitly provides one.
+ * cost, so known models receive a standard-tier API-equivalent estimate. An
+ * explicit cost from a compatible future event always takes precedence.
  */
-function attachUsage(result) {
+function attachUsage(result, model) {
     const events = (0, exit_conditions_cjs_1.parseCodexJsonEvents)(result.stdout);
     if (events.length === 0)
         return result;
     const usage = (0, exit_conditions_cjs_1.extractUsageFromCodexEvents)(events);
+    const costUsd = usage.costUsd ?? (0, codex_pricing_cjs_1.estimateCodexCostUsd)(events, model);
     const reportText = (0, exit_conditions_cjs_1.extractFinalMessageFromCodexEvents)(events) ?? undefined;
     return {
         ...result,
@@ -153,7 +156,7 @@ function attachUsage(result) {
         // measured zero — leave the fields unset so aggregation skips them.
         ...(usage.tokensIn !== undefined ? { tokensIn: usage.tokensIn } : {}),
         ...(usage.tokensOut !== undefined ? { tokensOut: usage.tokensOut } : {}),
-        ...(usage.costUsd !== undefined ? { costUsd: usage.costUsd } : {}),
+        ...(costUsd !== undefined ? { costUsd } : {}),
         ...(reportText !== undefined ? { reportText } : {}),
     };
 }

package/dist/codex-pricing.cjs

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.estimateCodexCostUsd = estimateCodexCostUsd;
+/**
+ * Standard-tier USD prices per 1M tokens. Codex's JSONL stream reports usage
+ * but not dollars, so the runtime needs a local price snapshot to turn that
+ * usage into project spend. Keep this deliberately limited to models Navarch
+ * offers rather than silently applying the wrong price to custom/gateway ids.
+ *
+ * Source (checked 2026-08-05): https://developers.openai.com/api/docs/pricing
+ */
+const CODEX_RATES = {
+    "gpt-5.6-sol": {
+        input: 5,
+        cachedInput: 0.5,
+        cacheWrite: 6.25,
+        output: 30,
+    },
+};
+function nonnegative(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
+}
+function priceUsage(usage, rates) {
+    const input = nonnegative(usage.input);
+    // Cached reads and cache writes are components of input_tokens, not extra
+    // tokens. Clamp malformed/provider-newer detail fields to the reported total
+    // so an odd event cannot produce negative uncached input or inflated spend.
+    const cachedInput = Math.min(input, nonnegative(usage.cachedInput));
+    const cacheWrite = Math.min(input - cachedInput, nonnegative(usage.cacheWrite));
+    const uncachedInput = input - cachedInput - cacheWrite;
+    const output = nonnegative(usage.output);
+    return (uncachedInput * rates.input +
+        cachedInput * rates.cachedInput +
+        cacheWrite * rates.cacheWrite +
+        output * rates.output) / 1_000_000;
+}
+/**
+ * Estimate standard-tier API-equivalent USD cost for a Codex JSONL run.
+ * Verified turn.completed events are per-turn and must be summed; legacy
+ * token_count envelopes are cumulative, so only their final total is priced.
+ * Returns undefined for unknown models or when no usage event was observed.
+ */
+function estimateCodexCostUsd(events, model) {
+    if (!model)
+        return undefined;
+    const rates = CODEX_RATES[model];
+    if (!rates)
+        return undefined;
+    let sawTurnUsage = false;
+    let turnCost = 0;
+    let legacyUsage;
+    for (const event of events) {
+        if (event.type === "turn.completed" && event.usage) {
+            sawTurnUsage = true;
+            turnCost += priceUsage({
+                input: event.usage.input_tokens,
+                cachedInput: event.usage.cached_input_tokens,
+                cacheWrite: event.usage.cache_write_input_tokens,
+                output: event.usage.output_tokens,
+            }, rates);
+        }
+        if (event.msg?.type === "token_count") {
+            const usage = event.msg.info?.total_token_usage;
+            legacyUsage = usage
+                ? {
+                    input: usage.input_tokens,
+                    cachedInput: usage.cached_input_tokens,
+                    cacheWrite: usage.cache_write_input_tokens,
+                    output: usage.output_tokens,
+                }
+                : {
+                    // In the oldest flat envelope cached_input_tokens was additional
+                    // to input_tokens; normalize it to the newer inclusive total.
+                    input: nonnegative(event.msg.input_tokens) + nonnegative(event.msg.cached_input_tokens),
+                    cachedInput: event.msg.cached_input_tokens,
+                    output: event.msg.output_tokens,
+                };
+        }
+        if (event.type === "event_msg" && event.payload?.type === "token_count") {
+            const usage = event.payload.info?.total_token_usage;
+            if (usage) {
+                legacyUsage = {
+                    input: usage.input_tokens,
+                    cachedInput: usage.cached_input_tokens,
+                    cacheWrite: usage.cache_write_input_tokens,
+                    output: usage.output_tokens,
+                };
+            }
+        }
+    }
+    if (sawTurnUsage)
+        return turnCost;
+    return legacyUsage ? priceUsage(legacyUsage, rates) : undefined;
+}

package/dist/git-worktree.cjs

@@ -11,9 +11,9 @@ const sandbox_cjs_1 = require("./sandbox.cjs");
 const repositoryLocks = new Map();
 /**
  * Maintains one bare repository cache per project and checks out each session
- * into its own uniquely named worktree. The cache avoids N full clones while
- * git's worktree metadata keeps concurrent agents from sharing an index or
- * working directory.
+ * into its own uniquely named worktree. Sessions that need a repo-local secret
+ * use an isolated bare repository under their session root because linked
+ * worktrees share their repository-local config.
  */
 class GitWorktree {
     sessionRoot;
@@ -23,22 +23,33 @@ class GitWorktree {
     runner;
     cloneUrl;
     githubToken;
+    repoLocalGithubToken;
     taskBranchSuffix;
+    legacyTaskBranchSuffix;
+    taskOwnershipTrailer;
+    sessionTokenMarker;
     constructor(options) {
         const projectKey = safePathSegment(options.projectId);
         const sessionKey = safePathSegment(options.sessionId);
         const taskKey = safePathSegment(options.taskId);
         this.sessionRoot = node_path_1.default.join(options.workspaceRoot, "sessions", sessionKey);
         this.worktreePath = node_path_1.default.join(this.sessionRoot, "repo");
-        this.repositoryPath = node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
+        this.repositoryPath = options.repoLocalGithubToken
+            ? node_path_1.default.join(this.sessionRoot, "repository.git")
+            : node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
         // One delivery task owns one remote branch across every retry. A
         // session-scoped branch lets a failed attempt push useful work, then makes
         // the retry start from main and open a second PR for the same task.
-        this.taskBranchSuffix = `-${taskKey.toLowerCase()}`;
+        const normalizedTaskId = taskKey.toLowerCase();
+        this.taskBranchSuffix = `-${normalizedTaskId.slice(0, 8)}`;
+        this.legacyTaskBranchSuffix = `-${normalizedTaskId}`;
+        this.taskOwnershipTrailer = `Navarch-Task-ID: ${normalizedTaskId}`;
+        this.sessionTokenMarker = `navarch-session-github-token:${sessionKey}`;
         this.branch = `navarch/${branchSlug(options)}${this.taskBranchSuffix}`;
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.cloneUrl = options.cloneUrl;
         this.githubToken = options.githubToken;
+        this.repoLocalGithubToken = options.repoLocalGithubToken;
     }
     async prepare() {
         await node_fs_1.promises.mkdir(node_path_1.default.dirname(this.repositoryPath), { recursive: true });
@@ -58,8 +69,31 @@ class GitWorktree {
                     `could not resolve the fetched start ref. The shared cache was preserved to avoid invalidating ` +
                     `active worktrees; retry after active sessions finish or repair the cache in place: ${errorMessage(error)}`);
             }
+            await this.installRepoLocalGithubToken();
         });
     }
+    /**
+     * Makes a broker-issued GitHub credential visible to workflows that require
+     * `git config --local --get codex.githubToken`.
+     *
+     * Git ignores command-scope, worktree-scope, and included values when
+     * `--local` is requested, so the compatibility key has to live in the bare
+     * repository config. Token-bearing sessions use an isolated repository to
+     * keep concurrent worktrees from observing the value. The marked block lets
+     * cleanup remove exactly this session's value. The secret is written via fs
+     * and never passed in argv or emitted by the command runner.
+     */
+    async installRepoLocalGithubToken() {
+        if (!this.repoLocalGithubToken)
+            return;
+        if (/[\0\r]/.test(this.repoLocalGithubToken)) {
+            throw new Error("Broker-issued GitHub credential contains unsupported control characters.");
+        }
+        const configPath = node_path_1.default.join(this.repositoryPath, "config");
+        const block = repoLocalGithubTokenBlock(this.sessionTokenMarker, this.repoLocalGithubToken);
+        await node_fs_1.promises.chmod(configPath, 0o600);
+        await node_fs_1.promises.appendFile(configPath, block, { encoding: "utf8", mode: 0o600 });
+    }
     /** Clones the bare cache if missing, repoints origin if needed, and fetches all branches. */
     async ensureRepositoryCache() {
         if (!(await pathExists(node_path_1.default.join(this.repositoryPath, "HEAD")))) {
@@ -84,11 +118,13 @@ class GitWorktree {
         // A failed session may have pushed before it could report completion. The
         // next session must resume that task-owned branch, not fork again from the
         // default branch and create a competing delivery PR.
-        const startRef = (await this.resolveTaskBranchRef()) ?? (await this.resolveStartRef());
+        const taskRef = await this.resolveTaskBranchRef();
+        const startRef = taskRef ?? (await this.resolveStartRef());
         if (!startRef) {
             // Empty remote (no commits yet): there is nothing to base the session on,
             // so bootstrap an orphan branch the session can push as the first commit.
             await this.addOrphanWorktree();
+            await this.createTaskOwnershipCommit();
             return;
         }
         await this.runGit([
@@ -101,16 +137,32 @@ class GitWorktree {
             this.worktreePath,
             startRef,
         ], false);
+        if (!taskRef)
+            await this.createTaskOwnershipCommit();
     }
     /** Returns the fetched task-owned remote branch when an earlier attempt pushed it. */
     async resolveTaskBranchRef() {
         const refs = await this.runGit(["--git-dir", this.repositoryPath, "for-each-ref", "--format=%(refname)", "refs/remotes/origin/navarch"], false);
-        const matches = refs.stdout
+        const suffixMatches = refs.stdout
             .split("\n")
             .map((line) => line.trim())
             .filter((ref) => ref.endsWith(this.taskBranchSuffix));
-        if (matches.length === 0)
+        const legacyMatches = refs.stdout
+            .split("\n")
+            .map((line) => line.trim())
+            .filter((ref) => ref.endsWith(this.legacyTaskBranchSuffix));
+        const shortMatches = suffixMatches.filter((ref) => !legacyMatches.includes(ref));
+        const ownedShortMatches = (await Promise.all(shortMatches.map(async (ref) => ({ ref, owned: await this.hasTaskOwnershipMarker(ref) }))))
+            .filter(({ owned }) => owned)
+            .map(({ ref }) => ref);
+        const matches = [...ownedShortMatches, ...legacyMatches];
+        if (matches.length === 0) {
+            if (shortMatches.length > 0) {
+                throw new Error(`Remote branch ${shortMatches[0]} shares task suffix ${this.taskBranchSuffix} but does not ` +
+                    `contain ownership marker ${this.taskOwnershipTrailer}; refusing to resume or fork.`);
+            }
             return null;
+        }
         if (matches.length > 1) {
             throw new Error(`Multiple remote branches claim task suffix ${this.taskBranchSuffix}; refusing to fork another delivery branch.`);
         }
@@ -118,6 +170,38 @@ class GitWorktree {
         this.branch = remoteRef.replace(/^refs\/remotes\/origin\//, "");
         return remoteRef;
     }
+    /** Short branch names are ambiguous without a full task-ID marker in their history. */
+    async hasTaskOwnershipMarker(ref) {
+        const log = await this.runGit([
+            "--git-dir",
+            this.repositoryPath,
+            "log",
+            "--format=%B",
+            "--fixed-strings",
+            `--grep=${this.taskOwnershipTrailer}`,
+            ref,
+        ], false);
+        return log.stdout
+            .split("\n")
+            .some((line) => line.trim() === this.taskOwnershipTrailer);
+    }
+    /** Records full task ownership without lengthening the human-facing branch name. */
+    async createTaskOwnershipCommit() {
+        await this.runGit([
+            "-C",
+            this.worktreePath,
+            "-c",
+            "user.name=Navarch",
+            "-c",
+            "user.email=runtime@navarch.local",
+            "commit",
+            "--allow-empty",
+            "-m",
+            "chore(navarch): claim task branch",
+            "-m",
+            this.taskOwnershipTrailer,
+        ], false);
+    }
     /**
      * Resolves the remote-tracking ref new session branches start from, or null
      * when the remote has no branches at all (a freshly provisioned empty repo).
@@ -176,6 +260,7 @@ class GitWorktree {
     }
     async cleanup() {
         await withRepositoryLock(this.repositoryPath, async () => {
+            await this.removeRepoLocalGithubToken();
             await this.runner
                 .run("git", ["--git-dir", this.repositoryPath, "worktree", "remove", "--force", this.worktreePath])
                 .catch(() => undefined);
@@ -187,6 +272,21 @@ class GitWorktree {
                 .catch(() => undefined);
         });
     }
+    async removeRepoLocalGithubToken() {
+        if (!this.repoLocalGithubToken)
+            return;
+        const configPath = node_path_1.default.join(this.repositoryPath, "config");
+        try {
+            const config = await node_fs_1.promises.readFile(configPath, "utf8");
+            const cleaned = removeMarkedConfigBlock(config, this.sessionTokenMarker);
+            if (cleaned !== config)
+                await node_fs_1.promises.writeFile(configPath, cleaned, { mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
     async runGit(args, authenticated) {
         const credentialArgs = authenticated && this.githubToken
             ? [
@@ -208,6 +308,31 @@ class GitWorktree {
     }
 }
 exports.GitWorktree = GitWorktree;
+function repoLocalGithubTokenBlock(marker, token) {
+    const escaped = token
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, "\\n")
+        .replace(/\t/g, "\\t")
+        .replace(/\u0008/g, "\\b");
+    return (`\n# ${marker}:begin\n` +
+        `[codex]\n` +
+        `\tgithubToken = "${escaped}"\n` +
+        `# ${marker}:end\n`);
+}
+function removeMarkedConfigBlock(config, marker) {
+    const begin = `# ${marker}:begin`;
+    const end = `# ${marker}:end`;
+    const start = config.indexOf(begin);
+    if (start < 0)
+        return config;
+    const blockStart = start > 0 && config[start - 1] === "\n" ? start - 1 : start;
+    const endStart = config.indexOf(end, start + begin.length);
+    if (endStart < 0)
+        return config;
+    const endNewline = config.indexOf("\n", endStart + end.length);
+    return config.slice(0, blockStart) + config.slice(endNewline < 0 ? config.length : endNewline + 1);
+}
 async function withRepositoryLock(key, work) {
     const previous = repositoryLocks.get(key) ?? Promise.resolve();
     let release;

package/dist/session.cjs

@@ -71,9 +71,11 @@ async function runSession(deps, claimed, sessionId) {
     await (0, worktree_janitor_cjs_1.markSessionWorkspaceActive)(workDir);
     const promptText = (0, prompt_cjs_1.renderPrompt)(task, bundle);
     await node_fs_1.promises.writeFile(node_path_1.default.join(workDir, "prompt.md"), promptText, "utf8");
-    // Secrets: initially fetched once, held only in memory (registry + env map below),
-    // never written to disk on the host. They only ever reach disk inside the
-    // sandbox's tmpfs (sandbox.cts injectEnv), which is wiped with the container.
+    // Secrets: initially fetched once and held in the registry + child env map.
+    // The broker-issued github-pat is additionally installed in the project-local
+    // git config after worktree creation for the mandated Codex gh bootstrap;
+    // GitWorktree.cleanup removes that session-marked entry before teardown.
+    // Docker env injection remains tmpfs-backed (sandbox.cts injectEnv).
     const registry = new redact_cjs_1.SecretRegistry();
     let secrets = {};
     let managedGithubCredential = false;
@@ -127,6 +129,7 @@ async function runSession(deps, claimed, sessionId) {
         sessionId,
         cloneUrl,
         githubToken,
+        repoLocalGithubToken: secrets["github-pat"],
     });
     const knownGuidanceIds = new Set((bundle.guidance ?? []).map((entry) => entry.id));
     const deliveredGuidance = [...(bundle.guidance ?? [])];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",