@sagentlab/navarch-runtime 0.1.36 → 0.1.37

package/README.md

@@ -361,6 +361,12 @@ as an explicit read-only mount.
   user or checked-in legacy `sandbox_mode` from silently disabling the
   generated profile; Codex authentication still comes from `CODEX_HOME`, and
   repository instructions such as `AGENTS.md` still load.
+  On macOS the profile also grants read access to `/Library/Developer` and
+  `/Applications` (Xcode and CoreSimulator, which `xcrun simctl` and
+  `xcodebuild` load) and write access to `~/Library/Developer` (simulator
+  devices and DerivedData); the Claude hook gets the same write root. Without
+  these, iOS builds and simulator tests fail under the sandbox with
+  `access to /Library/Developer/PrivateFrameworks/CoreSimulator.framework is blocked`.
 - **Gemini:** the runtime uses Gemini CLI's native sandbox with only the
   current worktree, shared gitdir, session `gh` config, and approved extra
   roots mounted. The `gh` config and lease MCP settings are read-only; header

package/dist/worktree-guard.cjs

@@ -7,6 +7,7 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
+exports.macosDeveloperWriteRoots = macosDeveloperWriteRoots;
 exports.sessionGhConfigDir = sessionGhConfigDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
@@ -74,9 +75,12 @@ async function prepareWorktreeGuard(options) {
     const hookScriptPath = guardHookScriptPath();
     const configPath = node_path_1.default.join(options.workDir, "worktree-guard.json");
     const settingsPath = node_path_1.default.join(options.workDir, "claude-settings.json");
+    const workspaceRoot = node_path_1.default.resolve(options.workspaceRoot);
     const allowedRoots = [
         options.worktreePath,
         options.repositoryPath,
+        // Xcode's per-user simulator/DerivedData state; see macosDeveloperWriteRoots.
+        ...macosDeveloperWriteRoots().filter((root) => !isPathInside(node_path_1.default.resolve(root), workspaceRoot)),
         ...(options.extraRoots ?? []),
     ];
     const deniedRoots = [options.workspaceRoot];
@@ -110,7 +114,7 @@ async function prepareWorktreeGuard(options) {
  * installations are sufficient for helpers such as apply_patch, npm, gh, and
  * browser evidence tooling.
  */
-function codexToolReadRoots(env = process.env) {
+function codexToolReadRoots(env = process.env, platform = process.platform) {
     const homeDir = env.HOME?.trim() || node_os_1.default.homedir();
     const codexHome = env.CODEX_HOME?.trim() || node_path_1.default.join(homeDir, ".codex");
     return [
@@ -126,8 +130,31 @@ function codexToolReadRoots(env = process.env) {
         "/System/Library/CoreServices/SystemAppearance.bundle",
         node_path_1.default.join(homeDir, "Library", "Caches", "ms-playwright"),
         node_path_1.default.join(homeDir, ".cache", "ms-playwright"),
+        ...(platform === "darwin" ? MACOS_TOOLCHAIN_READ_ROOTS : []),
     ];
 }
+/**
+ * World-readable macOS toolchain locations. `xcrun simctl` / `xcodebuild`
+ * load /Library/Developer/PrivateFrameworks/CoreSimulator.framework and the
+ * Xcode bundle itself; without these an iOS build or simulator test dies
+ * under Codex's seatbelt with "access to ... is blocked". Both are already
+ * system prefixes for the Claude hook (bin/worktree-guard-hook.cjs), so this
+ * only brings the Codex profile level with it.
+ */
+const MACOS_TOOLCHAIN_READ_ROOTS = ["/Library/Developer", "/Applications"];
+/**
+ * Per-user macOS developer state that Xcode writes during a build or test
+ * run: simulator devices under `~/Library/Developer/CoreSimulator` and
+ * DerivedData under `~/Library/Developer/Xcode`. Shared between sessions on
+ * one machine (that is inherent to Xcode), but nothing under it is Navarch
+ * session state or credentials. Empty off macOS.
+ */
+function macosDeveloperWriteRoots(env = process.env, platform = process.platform) {
+    if (platform !== "darwin")
+        return [];
+    const homeDir = env.HOME?.trim() || node_os_1.default.homedir();
+    return [node_path_1.default.join(homeDir, "Library", "Developer")];
+}
 /**
  * Isolated gh configuration root for one coding-agent session.
  *
@@ -169,7 +196,7 @@ function codexWorktreeGuardArgs(options) {
             continue;
         filesystem[resolved] = "read";
     }
-    for (const root of options.extraRoots ?? []) {
+    for (const root of [...macosDeveloperWriteRoots(), ...(options.extraRoots ?? [])]) {
         const resolved = node_path_1.default.resolve(root);
         // Match the Claude hook's denied-root precedence: an extra root cannot
         // reopen sibling sessions or metadata inside the Navarch workspace.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, Gemini, or OpenCode.",
   "type": "commonjs",
   "license": "MIT",