@sagentlab/navarch-runtime 0.1.36 → 0.1.38

package/README.md

@@ -361,6 +361,14 @@ as an explicit read-only mount.
   user or checked-in legacy `sandbox_mode` from silently disabling the
   generated profile; Codex authentication still comes from `CODEX_HOME`, and
   repository instructions such as `AGENTS.md` still load.
+  On macOS the profile also grants read access to `/Library/Developer` and
+  `/Applications` (Xcode and CoreSimulator, which `xcrun simctl` and
+  `xcodebuild` load) and write access to `~/Library/Developer` (simulator
+  devices and DerivedData) and `~/Library/Caches/org.swift.swiftpm` (SwiftPM
+  repository, artifact, metadata, and manifest caches); the Claude hook gets
+  the same write roots. Without these, iOS builds and simulator tests fail
+  under the sandbox with
+  `access to /Library/Developer/PrivateFrameworks/CoreSimulator.framework is blocked`.
 - **Gemini:** the runtime uses Gemini CLI's native sandbox with only the
   current worktree, shared gitdir, session `gh` config, and approved extra
   roots mounted. The `gh` config and lease MCP settings are read-only; header

package/dist/worktree-guard.cjs

@@ -7,6 +7,7 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
+exports.macosDeveloperWriteRoots = macosDeveloperWriteRoots;
 exports.sessionGhConfigDir = sessionGhConfigDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
@@ -74,9 +75,12 @@ async function prepareWorktreeGuard(options) {
     const hookScriptPath = guardHookScriptPath();
     const configPath = node_path_1.default.join(options.workDir, "worktree-guard.json");
     const settingsPath = node_path_1.default.join(options.workDir, "claude-settings.json");
+    const workspaceRoot = node_path_1.default.resolve(options.workspaceRoot);
     const allowedRoots = [
         options.worktreePath,
         options.repositoryPath,
+        // Xcode and SwiftPM's per-user build state; see macosDeveloperWriteRoots.
+        ...macosDeveloperWriteRoots().filter((root) => !isPathInside(node_path_1.default.resolve(root), workspaceRoot)),
         ...(options.extraRoots ?? []),
     ];
     const deniedRoots = [options.workspaceRoot];
@@ -110,7 +114,7 @@ async function prepareWorktreeGuard(options) {
  * installations are sufficient for helpers such as apply_patch, npm, gh, and
  * browser evidence tooling.
  */
-function codexToolReadRoots(env = process.env) {
+function codexToolReadRoots(env = process.env, platform = process.platform) {
     const homeDir = env.HOME?.trim() || node_os_1.default.homedir();
     const codexHome = env.CODEX_HOME?.trim() || node_path_1.default.join(homeDir, ".codex");
     return [
@@ -126,6 +130,35 @@ function codexToolReadRoots(env = process.env) {
         "/System/Library/CoreServices/SystemAppearance.bundle",
         node_path_1.default.join(homeDir, "Library", "Caches", "ms-playwright"),
         node_path_1.default.join(homeDir, ".cache", "ms-playwright"),
+        ...(platform === "darwin" ? MACOS_TOOLCHAIN_READ_ROOTS : []),
+    ];
+}
+/**
+ * World-readable macOS toolchain locations. `xcrun simctl` / `xcodebuild`
+ * load /Library/Developer/PrivateFrameworks/CoreSimulator.framework and the
+ * Xcode bundle itself; without these an iOS build or simulator test dies
+ * under Codex's seatbelt with "access to ... is blocked". Both are already
+ * system prefixes for the Claude hook (bin/worktree-guard-hook.cjs), so this
+ * only brings the Codex profile level with it.
+ */
+const MACOS_TOOLCHAIN_READ_ROOTS = ["/Library/Developer", "/Applications"];
+/**
+ * Per-user macOS build state that Xcode and SwiftPM write during a build or
+ * test run: simulator devices and DerivedData under `~/Library/Developer`,
+ * plus SwiftPM's repository, artifact, package-metadata, and manifest caches
+ * under `~/Library/Caches/org.swift.swiftpm`. Shared between sessions on one
+ * machine (that is inherent to these tools), but nothing under these cache
+ * roots is Navarch session state or credentials. Deliberately do not grant
+ * `~/Library/org.swift.swiftpm` or `~/.swiftpm`, which may contain registry or
+ * security configuration. Empty off macOS.
+ */
+function macosDeveloperWriteRoots(env = process.env, platform = process.platform) {
+    if (platform !== "darwin")
+        return [];
+    const homeDir = env.HOME?.trim() || node_os_1.default.homedir();
+    return [
+        node_path_1.default.join(homeDir, "Library", "Developer"),
+        node_path_1.default.join(homeDir, "Library", "Caches", "org.swift.swiftpm"),
     ];
 }
 /**
@@ -169,7 +202,7 @@ function codexWorktreeGuardArgs(options) {
             continue;
         filesystem[resolved] = "read";
     }
-    for (const root of options.extraRoots ?? []) {
+    for (const root of [...macosDeveloperWriteRoots(), ...(options.extraRoots ?? [])]) {
         const resolved = node_path_1.default.resolve(root);
         // Match the Claude hook's denied-root precedence: an extra root cannot
         // reopen sibling sessions or metadata inside the Navarch workspace.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through Claude Code, Codex, Gemini, or OpenCode.",
   "type": "commonjs",
   "license": "MIT",