@sagentlab/navarch-runtime 0.1.41 → 0.1.43

package/README.md

@@ -326,7 +326,7 @@ unchanged across the deployment.
 | `NAVARCH_ACP_BIN` | `dsh` | Path/name of an Agent Client Protocol v1 stdio server. DeepSeek Harness is the default implementation. |
 | `NAVARCH_ACP_EXTRA_ARGS` | `--profile,acp` | Comma list of arguments used to start the ACP server. Override this together with `NAVARCH_ACP_BIN` for another ACP-compatible coding agent. |
 | `NAVARCH_MCP_CONFIG_PATH` | — | Path to the platform MCP config passed as `--mcp-config`. |
-| `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable. |
+| `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable it for every runtime on the machine — required to run OpenCode on the host. |
 | `NAVARCH_GUARD_EXTRA_ROOTS` | — | `path.delimiter`-separated (`:` on POSIX) extra directories the worktree guard allows beyond the session worktree, shared bare repo, and temp dirs. |
 
 ## Worktree boundary guard (host mode)
@@ -378,10 +378,13 @@ as an explicit read-only mount.
   Docker-mode sessions disable Gemini's implicit YOLO sandbox to avoid nesting
   it inside Navarch's already isolated session container.
 - **OpenCode:** the CLI cannot currently express a host-side boundary for all
-  shell side effects. With the guard enabled, host launches therefore fail
-  closed before the CLI starts. Run OpenCode in Docker with an operator-owned
-  image that contains an authenticated `opencode` binary, or set
-  `NAVARCH_WORKTREE_GUARD=off` only when the whole machine is already isolated.
+  shell side effects, so with the guard enabled it is resolved out of the
+  machine's advertised runtimes at startup — and a machine that offers only
+  OpenCode there refuses to start rather than claim tasks it can only fail.
+  Run OpenCode in Docker with an operator-owned image that contains an
+  authenticated `opencode` binary, or set `NAVARCH_WORKTREE_GUARD=off` only
+  when the whole machine is already isolated (the opt-out is machine-wide:
+  every runtime on it loses the boundary).
   OpenCode receives a private, per-session config, project config discovery is
   disabled, and lease MCP headers are referenced through child-only environment
   variables instead of being copied into its config file or argv.
@@ -445,15 +448,18 @@ export NAVARCH_AGENT=codex
 export NAVARCH_AGENT=gemini
 
 # OpenCode — requires an authenticated `opencode` CLI (or
-# NAVARCH_OPENCODE_BIN pointing at it). The guarded host path fails closed;
-# use a Docker image containing OpenCode for the normal isolated path.
+# NAVARCH_OPENCODE_BIN pointing at it). A guarded host refuses to start with
+# only this runtime; use a Docker image containing OpenCode for the normal
+# isolated path, or NAVARCH_WORKTREE_GUARD=off on an isolated machine.
 export NAVARCH_AGENT=opencode
 
 # Agent Client Protocol — defaults to DeepSeek Harness `dsh --profile acp`.
 # Override NAVARCH_ACP_BIN / NAVARCH_ACP_EXTRA_ARGS for another ACP v1 server.
 export NAVARCH_AGENT=acp
 
-# Advanced compatibility mode: advertise every installed adapter.
+# Advanced compatibility mode: advertise every installed adapter. On a guarded
+# host, `opencode` is dropped from this list (see the boundary notes above);
+# the rest are advertised as written.
 export NAVARCH_RUNTIMES=claude-code,codex,gemini,opencode,acp
 ```
 

package/dist/adapters/opencode.cjs

@@ -4,6 +4,7 @@ exports.openCodeAdapter = void 0;
 exports.runOpenCodeAdapter = runOpenCodeAdapter;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const config_cjs_1 = require("../config.cjs");
 /**
  * Headless OpenCode adapter, fixture-pinned to the OpenCode 1.18 JSON/config
  * contract:
@@ -24,9 +25,7 @@ async function runOpenCodeAdapter(options) {
             timedOut: false,
             killedByLeaseLoss: false,
             stdout: "",
-            stderr: "OpenCode cannot enforce Navarch's host worktree boundary for shell side effects. " +
-                "Use NAVARCH_SANDBOX_MODE=docker, or explicitly set NAVARCH_WORKTREE_GUARD=off " +
-                "only on an otherwise isolated machine.",
+            stderr: config_cjs_1.OPENCODE_HOST_GUARD_MESSAGE,
         };
     }
     const env = { ...options.env };

package/dist/cli.cjs

@@ -274,7 +274,19 @@ async function superviseCommand(flags) {
     process.exitCode = exitCode;
 }
 async function doctorCommand(flags) {
-    const config = configFromFlags(flags);
+    // doctor is the command an operator reaches for precisely when the config
+    // will not load — an OpenCode-only machine on a guarded host refuses to
+    // start (config.cts). Report that as the diagnosis instead of rethrowing it
+    // as a bare CLI error.
+    let config;
+    try {
+        config = configFromFlags(flags);
+    }
+    catch (err) {
+        console.log(`config:          UNUSABLE — ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+        return;
+    }
     const dockerOk = await (0, sandbox_cjs_1.isDockerAvailable)();
     console.log(`api_base:        ${config.apiBase}`);
     console.log(`config_dir:      ${config.configDir}`);
@@ -282,6 +294,8 @@ async function doctorCommand(flags) {
     console.log(`max_sessions:    ${config.maxSessions}`);
     console.log(`capabilities:    ${config.capabilities.join(", ")}`);
     console.log(`sandbox_mode:    ${config.sandboxMode}`);
+    console.log(`worktree_guard:  ${config.worktreeGuard ? "on" : "off"}`);
+    console.log(`runtimes:        ${config.runtimes?.join(", ") ?? config.agentType}`);
     console.log(`docker:          ${dockerOk ? "available" : "NOT AVAILABLE (docker-backed sessions will fail)"}`);
     let identity;
     try {

package/dist/config.cjs

@@ -3,8 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_SANDBOX_IMAGE = void 0;
+exports.OPENCODE_HOST_GUARD_MESSAGE = exports.DEFAULT_SANDBOX_IMAGE = void 0;
 exports.isRuntimeAgentType = isRuntimeAgentType;
+exports.opencodeBlockedOnHost = opencodeBlockedOnHost;
 exports.loadRuntimeConfig = loadRuntimeConfig;
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
@@ -44,6 +45,18 @@ function envList(env, name, fallback) {
         .map((s) => s.trim())
         .filter(Boolean);
 }
+/**
+ * OpenCode is the one runtime Navarch cannot fence into a per-session worktree
+ * on the host: its CLI has no equivalent of Claude's PreToolUse hook or
+ * Codex's native permission profile. Docker mode supplies the boundary
+ * instead, and NAVARCH_WORKTREE_GUARD=off is the explicit opt-out.
+ */
+function opencodeBlockedOnHost(sandboxMode, worktreeGuard) {
+    return sandboxMode === "host" && worktreeGuard;
+}
+exports.OPENCODE_HOST_GUARD_MESSAGE = "OpenCode cannot enforce Navarch's host worktree boundary for shell side effects. " +
+    "Use NAVARCH_SANDBOX_MODE=docker, or explicitly set NAVARCH_WORKTREE_GUARD=off " +
+    "only on an otherwise isolated machine.";
 /**
  * Loads runtime config from NAVARCH_* env vars, with sane defaults for a
  * fresh machine. Accepts an explicit env map (defaulting to process.env) so
@@ -57,8 +70,23 @@ function loadRuntimeConfig(env = process.env) {
     // prerequisite for claiming ordinary shell work.
     const sandboxMode = env.NAVARCH_SANDBOX_MODE === "docker" ? "docker" : "host";
     const defaultCapabilities = sandboxMode === "docker" ? ["docker-sandbox", "shell"] : ["shell", "browser-use"];
-    const agentType = isRuntimeAgentType(env.NAVARCH_AGENT) ? env.NAVARCH_AGENT : "claude-code";
-    const runtimes = envList(env, "NAVARCH_RUNTIMES", [agentType]).filter(isRuntimeAgentType);
+    const requestedAgentType = isRuntimeAgentType(env.NAVARCH_AGENT) ? env.NAVARCH_AGENT : "claude-code";
+    // Multiple sessions share one machine; keeping each agent inside its own
+    // worktree is the safe default, so disabling is the explicit opt-out.
+    const worktreeGuard = !["off", "false", "0"].includes(env.NAVARCH_WORKTREE_GUARD ?? "");
+    const requestedRuntimes = envList(env, "NAVARCH_RUNTIMES", [requestedAgentType]).filter(isRuntimeAgentType);
+    // OpenCode's CLI cannot express the host worktree boundary, so its adapter
+    // fails closed there (adapters/opencode.cts). Advertising it anyway meant
+    // the machine claimed OpenCode tasks it could only fail, one lease at a
+    // time; keep it out of the claim instead of discovering this per session.
+    const runnableRuntimes = requestedRuntimes.filter((runtime) => runtime !== "opencode" || !opencodeBlockedOnHost(sandboxMode, worktreeGuard));
+    if (requestedRuntimes.includes("opencode") && runnableRuntimes.length === 0) {
+        throw new Error(exports.OPENCODE_HOST_GUARD_MESSAGE);
+    }
+    const agentType = runnableRuntimes.includes(requestedAgentType) || runnableRuntimes.length === 0
+        ? requestedAgentType
+        : (runnableRuntimes[0] ?? requestedAgentType);
+    const runtimes = runnableRuntimes;
     return {
         apiBase: env.NAVARCH_API_BASE ?? "http://localhost:3000",
         workspaceRoot: env.NAVARCH_WORKSPACE_ROOT ?? node_path_1.default.join(configDir, "sandboxes"),
@@ -98,9 +126,7 @@ function loadRuntimeConfig(env = process.env) {
             : sandbox_profile_cjs_1.DEFAULT_SANDBOX_PROFILE_ID,
         sandboxEgressNetwork: env.NAVARCH_SANDBOX_EGRESS_NETWORK?.trim() || null,
         dockerImage: env.NAVARCH_DOCKER_IMAGE ?? exports.DEFAULT_SANDBOX_IMAGE,
-        // Multiple sessions share one machine; keeping each agent inside its own
-        // worktree is the safe default, so disabling is the explicit opt-out.
-        worktreeGuard: !["off", "false", "0"].includes(env.NAVARCH_WORKTREE_GUARD ?? ""),
+        worktreeGuard,
         guardExtraRoots: (env.NAVARCH_GUARD_EXTRA_ROOTS ?? "")
             .split(node_path_1.default.delimiter)
             .map((s) => s.trim())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",