@sagentlab/navarch-runtime 0.1.42 → 0.1.43

package/README.md

@@ -326,7 +326,7 @@ unchanged across the deployment.
 | `NAVARCH_ACP_BIN` | `dsh` | Path/name of an Agent Client Protocol v1 stdio server. DeepSeek Harness is the default implementation. |
 | `NAVARCH_ACP_EXTRA_ARGS` | `--profile,acp` | Comma list of arguments used to start the ACP server. Override this together with `NAVARCH_ACP_BIN` for another ACP-compatible coding agent. |
 | `NAVARCH_MCP_CONFIG_PATH` | — | Path to the platform MCP config passed as `--mcp-config`. |
-| `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable. |
+| `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable it for every runtime on the machine — required to run OpenCode on the host. |
 | `NAVARCH_GUARD_EXTRA_ROOTS` | — | `path.delimiter`-separated (`:` on POSIX) extra directories the worktree guard allows beyond the session worktree, shared bare repo, and temp dirs. |
 
 ## Worktree boundary guard (host mode)
@@ -378,10 +378,13 @@ as an explicit read-only mount.
   Docker-mode sessions disable Gemini's implicit YOLO sandbox to avoid nesting
   it inside Navarch's already isolated session container.
 - **OpenCode:** the CLI cannot currently express a host-side boundary for all
-  shell side effects. With the guard enabled, host launches therefore fail
-  closed before the CLI starts. Run OpenCode in Docker with an operator-owned
-  image that contains an authenticated `opencode` binary, or set
-  `NAVARCH_WORKTREE_GUARD=off` only when the whole machine is already isolated.
+  shell side effects, so with the guard enabled it is resolved out of the
+  machine's advertised runtimes at startup — and a machine that offers only
+  OpenCode there refuses to start rather than claim tasks it can only fail.
+  Run OpenCode in Docker with an operator-owned image that contains an
+  authenticated `opencode` binary, or set `NAVARCH_WORKTREE_GUARD=off` only
+  when the whole machine is already isolated (the opt-out is machine-wide:
+  every runtime on it loses the boundary).
   OpenCode receives a private, per-session config, project config discovery is
   disabled, and lease MCP headers are referenced through child-only environment
   variables instead of being copied into its config file or argv.
@@ -445,15 +448,18 @@ export NAVARCH_AGENT=codex
 export NAVARCH_AGENT=gemini
 
 # OpenCode — requires an authenticated `opencode` CLI (or
-# NAVARCH_OPENCODE_BIN pointing at it). The guarded host path fails closed;
-# use a Docker image containing OpenCode for the normal isolated path.
+# NAVARCH_OPENCODE_BIN pointing at it). A guarded host refuses to start with
+# only this runtime; use a Docker image containing OpenCode for the normal
+# isolated path, or NAVARCH_WORKTREE_GUARD=off on an isolated machine.
 export NAVARCH_AGENT=opencode
 
 # Agent Client Protocol — defaults to DeepSeek Harness `dsh --profile acp`.
 # Override NAVARCH_ACP_BIN / NAVARCH_ACP_EXTRA_ARGS for another ACP v1 server.
 export NAVARCH_AGENT=acp
 
-# Advanced compatibility mode: advertise every installed adapter.
+# Advanced compatibility mode: advertise every installed adapter. On a guarded
+# host, `opencode` is dropped from this list (see the boundary notes above);
+# the rest are advertised as written.
 export NAVARCH_RUNTIMES=claude-code,codex,gemini,opencode,acp
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",