@sagentlab/navarch-runtime 0.1.21 → 0.1.22

package/dist/git-worktree.cjs

@@ -11,9 +11,9 @@ const sandbox_cjs_1 = require("./sandbox.cjs");
 const repositoryLocks = new Map();
 /**
  * Maintains one bare repository cache per project and checks out each session
- * into its own uniquely named worktree. The cache avoids N full clones while
- * git's worktree metadata keeps concurrent agents from sharing an index or
- * working directory.
+ * into its own uniquely named worktree. Sessions that need a repo-local secret
+ * use an isolated bare repository under their session root because linked
+ * worktrees share their repository-local config.
  */
 class GitWorktree {
     sessionRoot;
@@ -23,16 +23,20 @@ class GitWorktree {
     runner;
     cloneUrl;
     githubToken;
+    repoLocalGithubToken;
     taskBranchSuffix;
     legacyTaskBranchSuffix;
     taskOwnershipTrailer;
+    sessionTokenMarker;
     constructor(options) {
         const projectKey = safePathSegment(options.projectId);
         const sessionKey = safePathSegment(options.sessionId);
         const taskKey = safePathSegment(options.taskId);
         this.sessionRoot = node_path_1.default.join(options.workspaceRoot, "sessions", sessionKey);
         this.worktreePath = node_path_1.default.join(this.sessionRoot, "repo");
-        this.repositoryPath = node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
+        this.repositoryPath = options.repoLocalGithubToken
+            ? node_path_1.default.join(this.sessionRoot, "repository.git")
+            : node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
         // One delivery task owns one remote branch across every retry. A
         // session-scoped branch lets a failed attempt push useful work, then makes
         // the retry start from main and open a second PR for the same task.
@@ -40,10 +44,12 @@ class GitWorktree {
         this.taskBranchSuffix = `-${normalizedTaskId.slice(0, 8)}`;
         this.legacyTaskBranchSuffix = `-${normalizedTaskId}`;
         this.taskOwnershipTrailer = `Navarch-Task-ID: ${normalizedTaskId}`;
+        this.sessionTokenMarker = `navarch-session-github-token:${sessionKey}`;
         this.branch = `navarch/${branchSlug(options)}${this.taskBranchSuffix}`;
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.cloneUrl = options.cloneUrl;
         this.githubToken = options.githubToken;
+        this.repoLocalGithubToken = options.repoLocalGithubToken;
     }
     async prepare() {
         await node_fs_1.promises.mkdir(node_path_1.default.dirname(this.repositoryPath), { recursive: true });
@@ -63,8 +69,31 @@ class GitWorktree {
                     `could not resolve the fetched start ref. The shared cache was preserved to avoid invalidating ` +
                     `active worktrees; retry after active sessions finish or repair the cache in place: ${errorMessage(error)}`);
             }
+            await this.installRepoLocalGithubToken();
         });
     }
+    /**
+     * Makes a broker-issued GitHub credential visible to workflows that require
+     * `git config --local --get codex.githubToken`.
+     *
+     * Git ignores command-scope, worktree-scope, and included values when
+     * `--local` is requested, so the compatibility key has to live in the bare
+     * repository config. Token-bearing sessions use an isolated repository to
+     * keep concurrent worktrees from observing the value. The marked block lets
+     * cleanup remove exactly this session's value. The secret is written via fs
+     * and never passed in argv or emitted by the command runner.
+     */
+    async installRepoLocalGithubToken() {
+        if (!this.repoLocalGithubToken)
+            return;
+        if (/[\0\r]/.test(this.repoLocalGithubToken)) {
+            throw new Error("Broker-issued GitHub credential contains unsupported control characters.");
+        }
+        const configPath = node_path_1.default.join(this.repositoryPath, "config");
+        const block = repoLocalGithubTokenBlock(this.sessionTokenMarker, this.repoLocalGithubToken);
+        await node_fs_1.promises.chmod(configPath, 0o600);
+        await node_fs_1.promises.appendFile(configPath, block, { encoding: "utf8", mode: 0o600 });
+    }
     /** Clones the bare cache if missing, repoints origin if needed, and fetches all branches. */
     async ensureRepositoryCache() {
         if (!(await pathExists(node_path_1.default.join(this.repositoryPath, "HEAD")))) {
@@ -231,6 +260,7 @@ class GitWorktree {
     }
     async cleanup() {
         await withRepositoryLock(this.repositoryPath, async () => {
+            await this.removeRepoLocalGithubToken();
             await this.runner
                 .run("git", ["--git-dir", this.repositoryPath, "worktree", "remove", "--force", this.worktreePath])
                 .catch(() => undefined);
@@ -242,6 +272,21 @@ class GitWorktree {
                 .catch(() => undefined);
         });
     }
+    async removeRepoLocalGithubToken() {
+        if (!this.repoLocalGithubToken)
+            return;
+        const configPath = node_path_1.default.join(this.repositoryPath, "config");
+        try {
+            const config = await node_fs_1.promises.readFile(configPath, "utf8");
+            const cleaned = removeMarkedConfigBlock(config, this.sessionTokenMarker);
+            if (cleaned !== config)
+                await node_fs_1.promises.writeFile(configPath, cleaned, { mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
     async runGit(args, authenticated) {
         const credentialArgs = authenticated && this.githubToken
             ? [
@@ -263,6 +308,31 @@ class GitWorktree {
     }
 }
 exports.GitWorktree = GitWorktree;
+function repoLocalGithubTokenBlock(marker, token) {
+    const escaped = token
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, "\\n")
+        .replace(/\t/g, "\\t")
+        .replace(/\u0008/g, "\\b");
+    return (`\n# ${marker}:begin\n` +
+        `[codex]\n` +
+        `\tgithubToken = "${escaped}"\n` +
+        `# ${marker}:end\n`);
+}
+function removeMarkedConfigBlock(config, marker) {
+    const begin = `# ${marker}:begin`;
+    const end = `# ${marker}:end`;
+    const start = config.indexOf(begin);
+    if (start < 0)
+        return config;
+    const blockStart = start > 0 && config[start - 1] === "\n" ? start - 1 : start;
+    const endStart = config.indexOf(end, start + begin.length);
+    if (endStart < 0)
+        return config;
+    const endNewline = config.indexOf("\n", endStart + end.length);
+    return config.slice(0, blockStart) + config.slice(endNewline < 0 ? config.length : endNewline + 1);
+}
 async function withRepositoryLock(key, work) {
     const previous = repositoryLocks.get(key) ?? Promise.resolve();
     let release;

package/dist/session.cjs

@@ -71,9 +71,11 @@ async function runSession(deps, claimed, sessionId) {
     await (0, worktree_janitor_cjs_1.markSessionWorkspaceActive)(workDir);
     const promptText = (0, prompt_cjs_1.renderPrompt)(task, bundle);
     await node_fs_1.promises.writeFile(node_path_1.default.join(workDir, "prompt.md"), promptText, "utf8");
-    // Secrets: initially fetched once, held only in memory (registry + env map below),
-    // never written to disk on the host. They only ever reach disk inside the
-    // sandbox's tmpfs (sandbox.cts injectEnv), which is wiped with the container.
+    // Secrets: initially fetched once and held in the registry + child env map.
+    // The broker-issued github-pat is additionally installed in the project-local
+    // git config after worktree creation for the mandated Codex gh bootstrap;
+    // GitWorktree.cleanup removes that session-marked entry before teardown.
+    // Docker env injection remains tmpfs-backed (sandbox.cts injectEnv).
     const registry = new redact_cjs_1.SecretRegistry();
     let secrets = {};
     let managedGithubCredential = false;
@@ -127,6 +129,7 @@ async function runSession(deps, claimed, sessionId) {
         sessionId,
         cloneUrl,
         githubToken,
+        repoLocalGithubToken: secrets["github-pat"],
     });
     const knownGuidanceIds = new Set((bundle.guidance ?? []).map((entry) => entry.id));
     const deliveredGuidance = [...(bundle.guidance ?? [])];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",