@sagentlab/navarch-runtime 0.1.21 → 0.1.23

package/dist/exit-conditions.cjs

@@ -5,6 +5,7 @@ exports.extractUsageFromClaudeJson = extractUsageFromClaudeJson;
 exports.parseCodexJsonEvents = parseCodexJsonEvents;
 exports.extractUsageFromCodexEvents = extractUsageFromCodexEvents;
 exports.extractFinalMessageFromCodexEvents = extractFinalMessageFromCodexEvents;
+exports.leadingVerificationVerdict = leadingVerificationVerdict;
 exports.mapExitCondition = mapExitCondition;
 /**
  * Best-effort parse of `claude -p --output-format json` stdout into the
@@ -158,6 +159,21 @@ function extractFinalMessageFromCodexEvents(events) {
     }
     return null;
 }
+/**
+ * Parses the leading `Verification verdict:` line convention shared with the
+ * control plane (lib/navarch/verification-verdict.ts). Verify completions
+ * must open with `Verification verdict: PASS|FAIL|BLOCKED`, and the
+ * completion API rejects a completion whose verdict contradicts its lease
+ * outcome, keeping the lease active.
+ */
+function leadingVerificationVerdict(report) {
+    const firstLine = report
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .find(Boolean);
+    const match = /^Verification verdict:\s*(PASS|FAIL|BLOCKED)\b/i.exec(firstLine ?? "");
+    return match?.[1] ? match[1].toLowerCase() : null;
+}
 function summarize(text, maxLen = 500) {
     const trimmed = text.trim();
     if (!trimmed)
@@ -234,6 +250,19 @@ function mapExitCondition(result) {
     // parseClaudeJsonResult's doc comment).
     const reportText = result.reportText ?? parsedJson?.result ?? result.stdout;
     const reportSummary = summarize(reportText) || "Adapter completed with no report text.";
+    // A verify agent's FAIL/BLOCKED verdict is a successful agent run whose
+    // conclusion is that the delivery did not pass. The completion API only
+    // accepts those verdicts with a failed outcome, so map them to a failed
+    // lease instead of posting a "completed" the control plane must reject.
+    const verdict = leadingVerificationVerdict(reportText);
+    if (verdict === "fail" || verdict === "blocked") {
+        return {
+            leaseOutcome: "failed",
+            exitStatus: "failed",
+            reportSummary,
+            evidenceUrls,
+        };
+    }
     // Headless agent CLIs normally exit 0 after producing a final response,
     // including when that response says the task could not start. Treat an
     // explicit leading blocked verdict as a failed lease so the dispatcher can

package/dist/git-worktree.cjs

@@ -11,9 +11,9 @@ const sandbox_cjs_1 = require("./sandbox.cjs");
 const repositoryLocks = new Map();
 /**
  * Maintains one bare repository cache per project and checks out each session
- * into its own uniquely named worktree. The cache avoids N full clones while
- * git's worktree metadata keeps concurrent agents from sharing an index or
- * working directory.
+ * into its own uniquely named worktree. Sessions that need a repo-local secret
+ * use an isolated bare repository under their session root because linked
+ * worktrees share their repository-local config.
  */
 class GitWorktree {
     sessionRoot;
@@ -23,16 +23,20 @@ class GitWorktree {
     runner;
     cloneUrl;
     githubToken;
+    repoLocalGithubToken;
     taskBranchSuffix;
     legacyTaskBranchSuffix;
     taskOwnershipTrailer;
+    sessionTokenMarker;
     constructor(options) {
         const projectKey = safePathSegment(options.projectId);
         const sessionKey = safePathSegment(options.sessionId);
         const taskKey = safePathSegment(options.taskId);
         this.sessionRoot = node_path_1.default.join(options.workspaceRoot, "sessions", sessionKey);
         this.worktreePath = node_path_1.default.join(this.sessionRoot, "repo");
-        this.repositoryPath = node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
+        this.repositoryPath = options.repoLocalGithubToken
+            ? node_path_1.default.join(this.sessionRoot, "repository.git")
+            : node_path_1.default.join(options.workspaceRoot, "repositories", `${projectKey}.git`);
         // One delivery task owns one remote branch across every retry. A
         // session-scoped branch lets a failed attempt push useful work, then makes
         // the retry start from main and open a second PR for the same task.
@@ -40,10 +44,12 @@ class GitWorktree {
         this.taskBranchSuffix = `-${normalizedTaskId.slice(0, 8)}`;
         this.legacyTaskBranchSuffix = `-${normalizedTaskId}`;
         this.taskOwnershipTrailer = `Navarch-Task-ID: ${normalizedTaskId}`;
+        this.sessionTokenMarker = `navarch-session-github-token:${sessionKey}`;
         this.branch = `navarch/${branchSlug(options)}${this.taskBranchSuffix}`;
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
         this.cloneUrl = options.cloneUrl;
         this.githubToken = options.githubToken;
+        this.repoLocalGithubToken = options.repoLocalGithubToken;
     }
     async prepare() {
         await node_fs_1.promises.mkdir(node_path_1.default.dirname(this.repositoryPath), { recursive: true });
@@ -63,8 +69,31 @@ class GitWorktree {
                     `could not resolve the fetched start ref. The shared cache was preserved to avoid invalidating ` +
                     `active worktrees; retry after active sessions finish or repair the cache in place: ${errorMessage(error)}`);
             }
+            await this.installRepoLocalGithubToken();
         });
     }
+    /**
+     * Makes a broker-issued GitHub credential visible to workflows that require
+     * `git config --local --get codex.githubToken`.
+     *
+     * Git ignores command-scope, worktree-scope, and included values when
+     * `--local` is requested, so the compatibility key has to live in the bare
+     * repository config. Token-bearing sessions use an isolated repository to
+     * keep concurrent worktrees from observing the value. The marked block lets
+     * cleanup remove exactly this session's value. The secret is written via fs
+     * and never passed in argv or emitted by the command runner.
+     */
+    async installRepoLocalGithubToken() {
+        if (!this.repoLocalGithubToken)
+            return;
+        if (/[\0\r]/.test(this.repoLocalGithubToken)) {
+            throw new Error("Broker-issued GitHub credential contains unsupported control characters.");
+        }
+        const configPath = node_path_1.default.join(this.repositoryPath, "config");
+        const block = repoLocalGithubTokenBlock(this.sessionTokenMarker, this.repoLocalGithubToken);
+        await node_fs_1.promises.chmod(configPath, 0o600);
+        await node_fs_1.promises.appendFile(configPath, block, { encoding: "utf8", mode: 0o600 });
+    }
     /** Clones the bare cache if missing, repoints origin if needed, and fetches all branches. */
     async ensureRepositoryCache() {
         if (!(await pathExists(node_path_1.default.join(this.repositoryPath, "HEAD")))) {
@@ -231,6 +260,7 @@ class GitWorktree {
     }
     async cleanup() {
         await withRepositoryLock(this.repositoryPath, async () => {
+            await this.removeRepoLocalGithubToken();
             await this.runner
                 .run("git", ["--git-dir", this.repositoryPath, "worktree", "remove", "--force", this.worktreePath])
                 .catch(() => undefined);
@@ -242,6 +272,21 @@ class GitWorktree {
                 .catch(() => undefined);
         });
     }
+    async removeRepoLocalGithubToken() {
+        if (!this.repoLocalGithubToken)
+            return;
+        const configPath = node_path_1.default.join(this.repositoryPath, "config");
+        try {
+            const config = await node_fs_1.promises.readFile(configPath, "utf8");
+            const cleaned = removeMarkedConfigBlock(config, this.sessionTokenMarker);
+            if (cleaned !== config)
+                await node_fs_1.promises.writeFile(configPath, cleaned, { mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
     async runGit(args, authenticated) {
         const credentialArgs = authenticated && this.githubToken
             ? [
@@ -263,6 +308,31 @@ class GitWorktree {
     }
 }
 exports.GitWorktree = GitWorktree;
+function repoLocalGithubTokenBlock(marker, token) {
+    const escaped = token
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, "\\n")
+        .replace(/\t/g, "\\t")
+        .replace(/\u0008/g, "\\b");
+    return (`\n# ${marker}:begin\n` +
+        `[codex]\n` +
+        `\tgithubToken = "${escaped}"\n` +
+        `# ${marker}:end\n`);
+}
+function removeMarkedConfigBlock(config, marker) {
+    const begin = `# ${marker}:begin`;
+    const end = `# ${marker}:end`;
+    const start = config.indexOf(begin);
+    if (start < 0)
+        return config;
+    const blockStart = start > 0 && config[start - 1] === "\n" ? start - 1 : start;
+    const endStart = config.indexOf(end, start + begin.length);
+    if (endStart < 0)
+        return config;
+    const endNewline = config.indexOf("\n", endStart + end.length);
+    return config.slice(0, blockStart) + config.slice(endNewline < 0 ? config.length : endNewline + 1);
+}
 async function withRepositoryLock(key, work) {
     const previous = repositoryLocks.get(key) ?? Promise.resolve();
     let release;

package/dist/session.cjs

@@ -71,9 +71,11 @@ async function runSession(deps, claimed, sessionId) {
     await (0, worktree_janitor_cjs_1.markSessionWorkspaceActive)(workDir);
     const promptText = (0, prompt_cjs_1.renderPrompt)(task, bundle);
     await node_fs_1.promises.writeFile(node_path_1.default.join(workDir, "prompt.md"), promptText, "utf8");
-    // Secrets: initially fetched once, held only in memory (registry + env map below),
-    // never written to disk on the host. They only ever reach disk inside the
-    // sandbox's tmpfs (sandbox.cts injectEnv), which is wiped with the container.
+    // Secrets: initially fetched once and held in the registry + child env map.
+    // The broker-issued github-pat is additionally installed in the project-local
+    // git config after worktree creation for the mandated Codex gh bootstrap;
+    // GitWorktree.cleanup removes that session-marked entry before teardown.
+    // Docker env injection remains tmpfs-backed (sandbox.cts injectEnv).
     const registry = new redact_cjs_1.SecretRegistry();
     let secrets = {};
     let managedGithubCredential = false;
@@ -105,7 +107,7 @@ async function runSession(deps, claimed, sessionId) {
         const failureSummary = `Project ${task.project_id} has no GitHub repository URL. Set it in Project settings before dispatching work.`;
         await api.completeLease(leaseId, {
             status: "failed",
-            report: failureSummary,
+            report: verificationFailureReport(task.task_type, failureSummary),
             failure_summary: failureSummary,
             evidence_urls: [],
             cost: { tokens_in: 0, tokens_out: 0, cost_usd: 0 },
@@ -127,6 +129,7 @@ async function runSession(deps, claimed, sessionId) {
         sessionId,
         cloneUrl,
         githubToken,
+        repoLocalGithubToken: secrets["github-pat"],
     });
     const knownGuidanceIds = new Set((bundle.guidance ?? []).map((entry) => entry.id));
     const deliveredGuidance = [...(bundle.guidance ?? [])];
@@ -178,7 +181,7 @@ async function runSession(deps, claimed, sessionId) {
         await api
             .completeLease(leaseId, {
             status: "failed",
-            report: "Docker sandbox unavailable on this machine.",
+            report: verificationFailureReport(task.task_type, "Docker sandbox unavailable on this machine."),
             failure_summary: "Docker sandbox unavailable on this machine.",
             evidence_urls: [],
             cost: { tokens_in: 0, tokens_out: 0, cost_usd: 0 },
@@ -392,9 +395,12 @@ async function runSession(deps, claimed, sessionId) {
                 // redact it like every other warn in this block.
                 log.warn(`transcript upload failed for ${leaseId}: ${(0, redact_cjs_1.redactText)(String(err), knownSecrets)}`);
             }
+            const redactedReport = (0, redact_cjs_1.redactText)(mapping.reportSummary, knownSecrets);
             const completion = {
                 status: mapping.leaseOutcome,
-                report: (0, redact_cjs_1.redactText)(mapping.reportSummary, knownSecrets),
+                report: mapping.leaseOutcome === "failed"
+                    ? verificationFailureReport(task.task_type, redactedReport)
+                    : redactedReport,
                 evidence_urls: mapping.evidenceUrls,
                 cost: {
                     ...(result.tokensIn !== undefined ? { tokens_in: result.tokensIn } : {}),
@@ -445,9 +451,9 @@ async function runSession(deps, claimed, sessionId) {
                     await api.completeLease(leaseId, {
                         ...completion,
                         status: "failed",
-                        report: remediable
+                        report: verificationFailureReport(task.task_type, remediable
                             ? redactedRejection
-                            : `${redactedRejection}\n\n---\n\n${completion.report}`,
+                            : `${redactedRejection}\n\n---\n\n${completion.report}`),
                         failure_summary: redactedRejection,
                         exit_status: "failed",
                     });
@@ -479,9 +485,9 @@ async function runSession(deps, claimed, sessionId) {
         await api
             .completeLease(leaseId, {
             status: "failed",
-            report: lastCompletion
+            report: verificationFailureReport(task.task_type, lastCompletion
                 ? `${lastCompletion.report}\n\n---\n\n${failureSummary}`
-                : failureSummary,
+                : failureSummary),
             failure_summary: failureSummary,
             evidence_urls: lastCompletion?.evidence_urls ?? [],
             cost: lastCompletion?.cost ?? { tokens_in: 0, tokens_out: 0, cost_usd: 0 },
@@ -522,6 +528,24 @@ function sumReportedUsage(attempts, key) {
     });
     return reported.length > 0 ? reported.reduce((sum, value) => sum + value, 0) : undefined;
 }
+/**
+ * The control plane refuses to release a verify lease whose failed completion
+ * does not open with `Verification verdict: FAIL` or `BLOCKED`
+ * (verification_verdict_invalid), and that gate applies to runtime-authored
+ * failure reports too. When the report carries no usable verdict — the agent
+ * crashed, timed out, exited non-zero, or opened with PASS despite the failed
+ * outcome — label it BLOCKED: the failure prevented an acceptance decision.
+ * Without this, the failure completion is itself rejected, the session
+ * crashes, and the lease dangles until expiry.
+ */
+function verificationFailureReport(taskType, report) {
+    if (taskType !== "verify")
+        return report;
+    const verdict = (0, exit_conditions_cjs_1.leadingVerificationVerdict)(report);
+    if (verdict === "fail" || verdict === "blocked")
+        return report;
+    return `Verification verdict: BLOCKED — the session ended before verification reached an acceptance decision.\n\n${report}`;
+}
 /** Rejection codes another agent turn in the same worktree can plausibly fix. */
 const REMEDIABLE_REJECTION_CODES = new Set([
     "pr_required",
@@ -533,6 +557,12 @@ const REMEDIABLE_REJECTION_CODES = new Set([
     // The marker is already on the right head; the reviewer only has to relabel
     // the body, which is exactly what a remediation turn can do.
     "review_evidence_mislabeled",
+    // A verify agent that exited zero without the mandated leading
+    // `Verification verdict:` line only has to restate its report; the
+    // rejection prose spells out the exact format. Failed outcomes never reach
+    // remediation (see the leaseOutcome === "completed" gate) — their reports
+    // are verdict-labelled by verificationFailureReport before posting.
+    "verification_verdict_invalid",
 ]);
 /**
  * A 409 the control plane raised to reject *this* completion's contents (as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, or Gemini CLI.",
   "type": "commonjs",
   "license": "MIT",