@sagentlab/navarch-runtime 0.1.34 → 0.1.36

package/README.md

@@ -233,6 +233,15 @@ accepted. Rollouts are assigned by the machine's server-managed `stable` or
 `canary` channel and deterministic rollout percentage. Set
 `NAVARCH_AUTO_UPDATE=off` to keep telemetry but disable automatic activation.
 
+Project owners can also request a same-version restart from the project Agents
+page. Only a worker running under `navarch-runtime supervise` advertises this
+capability. The restart command arrives on the normal machine heartbeat; the
+worker stops claiming, reports zero capacity, drains active sessions, and exits
+with a restart-only handoff code. The supervisor respawns the current verified
+binary without staging an update. The control plane acknowledges the one-shot
+command only after a heartbeat reports a different boot ID, preventing a stale
+command from causing a restart loop.
+
 Plain `navarch-runtime start` continues to work and reports available releases,
 but deliberately does not activate them because no parent process would exist
 to perform a safe handoff or rollback.

package/dist/adapters/pi.cjs

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.piAdapter = exports.DEFAULT_HOSTED_PI_MODEL = exports.HOSTED_PI_MODELS = exports.DEEPSEEK_API_KEY_ENV = exports.PI_PROVIDER_NAME = void 0;
+exports.piAdapter = exports.HOSTED_PI_MAX_PROVIDER_TURNS = exports.DEFAULT_HOSTED_PI_MODEL = exports.HOSTED_PI_MODELS = exports.DEEPSEEK_API_KEY_ENV = exports.PI_PROVIDER_NAME = void 0;
+exports.buildHostedPiBudgetExtension = buildHostedPiBudgetExtension;
 exports.resolveHostedPiModel = resolveHostedPiModel;
 exports.buildPiProviderConfig = buildPiProviderConfig;
 exports.parsePiJsonEvents = parsePiJsonEvents;
@@ -27,9 +28,9 @@ const node_path_1 = __importDefault(require("node:path"));
  * shared parsing/provider-config contract.
  *
  * Secret hygiene: the generated models.json references the DeepSeek key ONLY
- * as a `$DEEPSEEK_API_KEY` environment interpolation (Pi expands it from the
- * child environment at load time). The literal key never appears in argv, in
- * the config file, or in any file that survives cleanup. A missing
+ * as the `DEEPSEEK_API_KEY` environment-variable name (Pi resolves it from
+ * the child environment at request time). The literal key never appears in
+ * argv, in the config file, or in any file that survives cleanup. A missing
  * DEEPSEEK_API_KEY in the session environment is a hard configuration
  * failure — the adapter refuses to launch rather than fall back to an
  * ambient credential.
@@ -47,6 +48,17 @@ exports.PI_PROVIDER_NAME = "deepseek";
 exports.DEEPSEEK_API_KEY_ENV = "DEEPSEEK_API_KEY";
 exports.HOSTED_PI_MODELS = ["deepseek-v4-flash", "deepseek-v4-pro"];
 exports.DEFAULT_HOSTED_PI_MODEL = "deepseek-v4-flash";
+exports.HOSTED_PI_MAX_PROVIDER_TURNS = 3;
+function buildHostedPiBudgetExtension() {
+    return `export default function navarchHostedPiBudget(pi) {
+  let providerTurns = 0;
+  pi.on("turn_start", (_event, ctx) => {
+    providerTurns += 1;
+    if (providerTurns > ${exports.HOSTED_PI_MAX_PROVIDER_TURNS}) ctx.abort();
+  });
+}
+`;
+}
 function resolveHostedPiModel(configured) {
     const trimmed = (configured ?? "").trim();
     const bare = trimmed.startsWith(`${exports.PI_PROVIDER_NAME}/`)
@@ -88,7 +100,7 @@ function buildPiProviderConfig() {
             [exports.PI_PROVIDER_NAME]: {
                 baseUrl: "https://api.deepseek.com",
                 api: "openai-completions",
-                apiKey: `$${exports.DEEPSEEK_API_KEY_ENV}`,
+                apiKey: exports.DEEPSEEK_API_KEY_ENV,
                 models,
             },
         },
@@ -195,6 +207,13 @@ function attachPiOutput(result) {
 // Invocation
 // ---------------------------------------------------------------------------
 const CONTAINER_PI_DIR = "/tmp/navarch-pi-agent";
+const BUDGET_EXTENSION_NAME = "navarch-budget.js";
+function withBudgetExtension(args, extensionPath) {
+    const promptIndex = args.indexOf("-p");
+    if (promptIndex < 0)
+        return [...args, "--extension", extensionPath];
+    return [...args.slice(0, promptIndex), "--extension", extensionPath, ...args.slice(promptIndex)];
+}
 function hasArg(args, ...flags) {
     return args.some((arg) => flags.some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
 }
@@ -205,7 +224,7 @@ async function runPiAdapter(options) {
         throw new Error(`pi adapter: ${exports.DEEPSEEK_API_KEY_ENV} is missing from the session environment; ` +
             "the managed provider credential must be injected by the hosted runner");
     }
-    const args = ["--mode", "json"];
+    const args = ["--mode", "json", "--no-extensions"];
     if (!hasArg(options.extraArgs, "--no-session")) {
         // Ephemeral by default: session persistence would leave conversation
         // files (which may quote repository content) behind after cleanup.
@@ -215,9 +234,9 @@ async function runPiAdapter(options) {
     const model = resolveHostedPiModel(options.model);
     args.push("--model", `${exports.PI_PROVIDER_NAME}/${model}`);
     if (options.reasoningEffort) {
-        // Pi's --thinking accepts off|minimal|low|medium|high|xhigh|max; the
-        // resolved efforts are a subset, so they map directly.
-        args.push("--thinking", options.reasoningEffort);
+        // Pi 0.73.1 tops out at xhigh. Navarch's max effort must clamp rather
+        // than passing an invalid value that Pi warns about and ignores.
+        args.push("--thinking", options.reasoningEffort === "max" ? "xhigh" : options.reasoningEffort);
     }
     args.push("-p", options.prompt);
     const raw = options.dockerExec
@@ -230,14 +249,19 @@ async function runOnHost(options, args) {
     // reads) an operator's ~/.pi configuration/credentials.
     const agentDir = await node_fs_1.promises.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), "navarch-pi-agent-"));
     await node_fs_1.promises.writeFile(node_path_1.default.join(agentDir, "models.json"), buildPiProviderConfig(), { mode: 0o600 });
+    const budgetExtensionPath = node_path_1.default.join(agentDir, BUDGET_EXTENSION_NAME);
+    await node_fs_1.promises.writeFile(budgetExtensionPath, buildHostedPiBudgetExtension(), {
+        mode: 0o600,
+    });
     const env = { ...options.env, PI_CODING_AGENT_DIR: agentDir };
+    const boundedArgs = withBudgetExtension(args, budgetExtensionPath);
     try {
         return await new Promise((resolve) => {
             let stdout = "";
             let stderr = "";
             let timedOut = false;
             let killedByLeaseLoss = false;
-            const child = (0, node_child_process_1.spawn)(options.bin, args, {
+            const child = (0, node_child_process_1.spawn)(options.bin, boundedArgs, {
                 cwd: options.cwd,
                 env: { ...process.env, ...env },
             });
@@ -261,12 +285,24 @@ async function runOnHost(options, args) {
                 clearTimeout(timer);
                 options.signal?.removeEventListener("abort", onAbort);
                 stderr += `\n${String(err)}`;
-                resolve({ exitCode: null, timedOut, killedByLeaseLoss, stdout, stderr });
+                resolve({
+                    exitCode: null,
+                    timedOut,
+                    killedByLeaseLoss,
+                    stdout,
+                    stderr,
+                });
             });
             child.on("close", (code) => {
                 clearTimeout(timer);
                 options.signal?.removeEventListener("abort", onAbort);
-                resolve({ exitCode: code, timedOut, killedByLeaseLoss, stdout, stderr });
+                resolve({
+                    exitCode: code,
+                    timedOut,
+                    killedByLeaseLoss,
+                    stdout,
+                    stderr,
+                });
             });
         });
     }
@@ -276,12 +312,19 @@ async function runOnHost(options, args) {
 }
 async function runViaDocker(options, args) {
     const { containerName, runner } = options.dockerExec;
-    // The provider config carries no secret values (only the $DEEPSEEK_API_KEY
+    // The provider config carries no secret values (only the DEEPSEEK_API_KEY
     // env reference), so materializing it through the container shell is safe.
     const command = `[ -f /tmp/session.env ] && . /tmp/session.env; cd repo 2>/dev/null; ` +
         `mkdir -p ${CONTAINER_PI_DIR} && cat > ${CONTAINER_PI_DIR}/models.json <<'NAVARCH_PI_EOF'\n` +
         `${buildPiProviderConfig()}NAVARCH_PI_EOF\n` +
-        `PI_CODING_AGENT_DIR=${CONTAINER_PI_DIR} ${[options.bin, ...args].map(shellQuote).join(" ")}`;
+        `cat > ${CONTAINER_PI_DIR}/${BUDGET_EXTENSION_NAME} <<'NAVARCH_PI_BUDGET_EOF'\n` +
+        `${buildHostedPiBudgetExtension()}NAVARCH_PI_BUDGET_EOF\n` +
+        `PI_CODING_AGENT_DIR=${CONTAINER_PI_DIR} ${[
+            options.bin,
+            ...withBudgetExtension(args, `${CONTAINER_PI_DIR}/${BUDGET_EXTENSION_NAME}`),
+        ]
+            .map(shellQuote)
+            .join(" ")}`;
     let killedByLeaseLoss = false;
     const onAbort = () => {
         killedByLeaseLoss = true;
@@ -290,7 +333,10 @@ async function runViaDocker(options, args) {
     options.signal?.addEventListener("abort", onAbort, { once: true });
     try {
         const forwardedEnv = Object.keys(options.env).flatMap((name) => ["--env", name]);
-        const result = await runner.run("docker", ["exec", ...forwardedEnv, containerName, "sh", "-c", command], { timeoutMs: options.timeoutMs, env: { ...process.env, ...options.env } });
+        const result = await runner.run("docker", ["exec", ...forwardedEnv, containerName, "sh", "-c", command], {
+            timeoutMs: options.timeoutMs,
+            env: { ...process.env, ...options.env },
+        });
         return {
             exitCode: result.code,
             timedOut: false,

package/dist/cli.cjs

@@ -207,7 +207,12 @@ async function startCommand(flags) {
     const bootId = (0, node_crypto_1.randomUUID)();
     const updateCoordinatorRef = {};
     let readySent = false;
-    const heartbeat = new heartbeat_loop_cjs_1.MachineHeartbeatLoop(api, identity.machine_id, config, capacity, bootId, (result) => updateCoordinatorRef.current?.consider(result.update), () => {
+    const heartbeat = new heartbeat_loop_cjs_1.MachineHeartbeatLoop(api, identity.machine_id, config, capacity, bootId, (result) => {
+        if (result.restart)
+            updateCoordinatorRef.current?.considerRestart(result.restart);
+        else
+            updateCoordinatorRef.current?.consider(result.update);
+    }, () => {
         if (!readySent && process.send) {
             readySent = true;
             process.send({ type: "navarch-ready", boot_id: bootId });

package/dist/config.cjs

@@ -103,6 +103,7 @@ function loadRuntimeConfig(env = process.env) {
             .map((s) => s.trim())
             .filter(Boolean),
         updateChannel: env.NAVARCH_UPDATE_CHANNEL === "canary" ? "canary" : "stable",
+        supervised: env.NAVARCH_SUPERVISED === "1",
         autoUpdate: env.NAVARCH_SUPERVISED === "1" &&
             !["off", "false", "0"].includes(env.NAVARCH_AUTO_UPDATE ?? ""),
         // Reads only the quota numbers providers already write to disk, so it is on

package/dist/heartbeat-loop.cjs

@@ -70,6 +70,8 @@ class MachineHeartbeatLoop {
                         ? await (0, usage_limits_cjs_1.collectAgentUsage)({
                             codexHome: this.config.codexHome,
                             claudeConfigPath: this.config.claudeConfigPath,
+                            providers: [...new Set([this.config.agentType, ...(this.config.runtimes ?? [])])]
+                                .filter((runtime) => runtime === "codex" || runtime === "claude-code"),
                         })
                         : null;
                     const result = await this.api.machineHeartbeat(this.machineId, {
@@ -82,6 +84,7 @@ class MachineHeartbeatLoop {
                             channel: this.config.updateChannel,
                             state: this.updateState,
                             boot_id: this.bootId,
+                            supervised: this.config.supervised,
                             ...(this.lastUpdateError ? { last_update_error: this.lastUpdateError } : {}),
                         },
                     });

package/dist/supervisor.cjs

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.REMOTE_RESTART_EXIT_CODE = void 0;
 exports.superviseRuntime = superviseRuntime;
 const node_child_process_1 = require("node:child_process");
 const logger_cjs_1 = require("./logger.cjs");
 const update_installer_cjs_1 = require("./update-installer.cjs");
 const log = (0, logger_cjs_1.createLogger)("supervisor");
 const UPDATE_RESTART_EXIT_CODE = 75;
+exports.REMOTE_RESTART_EXIT_CODE = 76;
 function runWorker(binPath, args, healthTimeoutMs, workerEnv, setCurrentChild, onHealthy) {
     return new Promise((resolve) => {
         const child = (0, node_child_process_1.spawn)(process.execPath, [binPath, "start", ...args], {
@@ -126,6 +128,10 @@ async function superviseRuntime(configDir, initialBinPath, workerArgs = [], heal
                 await (0, update_installer_cjs_1.clearPendingUpdate)(configDir);
                 continue;
             }
+            if (result.code === exports.REMOTE_RESTART_EXIT_CODE) {
+                log.info("remote restart requested; respawning current runtime");
+                continue;
+            }
             if (result.code !== UPDATE_RESTART_EXIT_CODE)
                 return result.code;
             const pending = await (0, update_installer_cjs_1.readPendingUpdate)(configDir);

package/dist/update-coordinator.cjs

@@ -4,16 +4,18 @@ exports.RuntimeUpdateCoordinator = void 0;
 const logger_cjs_1 = require("./logger.cjs");
 const update_installer_cjs_1 = require("./update-installer.cjs");
 const version_cjs_1 = require("./version.cjs");
+const supervisor_cjs_1 = require("./supervisor.cjs");
 const log = (0, logger_cjs_1.createLogger)("update");
 class RuntimeUpdateCoordinator {
     options;
     targetInProgress = null;
+    restartInProgress = null;
     warnedUnsupervised = false;
     constructor(options) {
         this.options = options;
     }
     consider(directive) {
-        if (!directive || directive.target_version === version_cjs_1.RUNTIME_VERSION)
+        if (!directive || directive.target_version === version_cjs_1.RUNTIME_VERSION || this.restartInProgress)
             return;
         if (!this.options.config.autoUpdate) {
             if (!this.warnedUnsupervised) {
@@ -27,6 +29,34 @@ class RuntimeUpdateCoordinator {
         this.targetInProgress = directive.target_version;
         void this.apply(directive);
     }
+    considerRestart(directive) {
+        if (!directive || this.targetInProgress || this.restartInProgress)
+            return;
+        if (!this.options.config.supervised) {
+            log.warn(`ignoring remote restart ${directive.command_id}: runtime is not supervised`);
+            return;
+        }
+        this.restartInProgress = directive.command_id;
+        void this.applyRestart(directive);
+    }
+    async applyRestart(directive) {
+        const { heartbeat, claimLoop, capacity } = this.options;
+        try {
+            heartbeat.setUpdateState("draining");
+            log.info(`remote restart ${directive.command_id} received; draining active sessions`);
+            await claimLoop.drain();
+            await capacity.waitForIdle();
+            log.info(`remote restart ${directive.command_id} ready; handing off to supervisor`);
+            (this.options.requestRestart ?? ((code) => process.exit(code)))(supervisor_cjs_1.REMOTE_RESTART_EXIT_CODE);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            log.error(`remote restart failed: ${message}`);
+            heartbeat.setUpdateState("failed", message.slice(0, 500));
+            claimLoop.start();
+            this.restartInProgress = null;
+        }
+    }
     async apply(directive) {
         const { config, heartbeat, claimLoop, capacity } = this.options;
         try {

package/dist/usage-limits.cjs

@@ -359,7 +359,9 @@ async function collectClaudeUsage(options) {
 }
 const DEFAULT_COLLECT_TIMEOUT_MS = 5_000;
 /**
- * Gathers every provider report available on this machine. Providers are read
+ * Gathers reports for the providers this runtime actually advertises. Provider
+ * CLIs can share a host, so scanning every state directory would attribute a
+ * different agent's quota to this machine. Selected providers are still read
  * independently so one unreadable or malformed source cannot suppress another,
  * and any thrown error degrades to "no report" rather than failing the caller.
  */
@@ -372,10 +374,15 @@ async function collectAgentUsage(options) {
         timer.unref?.();
     });
     try {
-        const collection = Promise.allSettled([
-            collectCodexUsage({ codexHome: options.codexHome, now: options.now }),
-            collectClaudeUsage({ configPath: options.claudeConfigPath, now: options.now }),
-        ]);
+        const providers = new Set(options.providers ?? ["codex", "claude-code"]);
+        const collectors = [];
+        if (providers.has("codex")) {
+            collectors.push(collectCodexUsage({ codexHome: options.codexHome, now: options.now }));
+        }
+        if (providers.has("claude-code")) {
+            collectors.push(collectClaudeUsage({ configPath: options.claudeConfigPath, now: options.now }));
+        }
+        const collection = Promise.allSettled(collectors);
         const settled = await Promise.race([collection, deadline]);
         if (!settled) {
             log.warn(`usage collection timed out after ${timeoutMs}ms`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, Gemini, or OpenCode.",
   "type": "commonjs",
   "license": "MIT",