@sagentlab/navarch-runtime 0.1.5 → 0.1.6

package/README.md

@@ -159,10 +159,60 @@ unchanged across the deployment.
 | `NAVARCH_DOCKER_IMAGE` | `node:20-slim` | Image used for the per-session container. |
 | `NAVARCH_AGENT` | saved choice, then `claude-code` | Local choice of agent CLI: `claude-code` or `codex`. Overrides the choice saved by `connect`/`register`; `start --agent` has highest priority. |
 | `NAVARCH_CLAUDE_BIN` | `claude` | Path/name of the Claude Code CLI binary. |
-| `NAVARCH_CLAUDE_EXTRA_ARGS` | — | Comma list of extra CLI args appended after `--mcp-config` (Claude Code). |
+| `NAVARCH_CLAUDE_EXTRA_ARGS` | — | Comma list of extra CLI args appended after `--mcp-config` (Claude Code). Supplying an explicit permission flag such as `--allowedTools` or `--permission-mode` replaces the unattended session's default `--dangerously-skip-permissions`. |
 | `NAVARCH_CODEX_BIN` | `codex` | Path/name of the Codex CLI binary. |
 | `NAVARCH_CODEX_EXTRA_ARGS` | — | Comma list of extra CLI args appended after the generated MCP `-c` overrides and `--json` (Codex). |
 | `NAVARCH_MCP_CONFIG_PATH` | — | Path to the platform MCP config passed as `--mcp-config`. |
+| `NAVARCH_WORKTREE_GUARD` | on | Host-mode Claude and Codex sessions get a per-session worktree boundary guard (see below). Set `off` to disable. |
+| `NAVARCH_GUARD_EXTRA_ROOTS` | — | `path.delimiter`-separated (`:` on POSIX) extra directories the worktree guard allows beyond the session worktree, shared bare repo, and temp dirs. |
+
+## Worktree boundary guard (host mode)
+
+A machine typically runs several sessions concurrently (`NAVARCH_MAX_SESSIONS`),
+each in its own git worktree. The runtime enforces the same boundary for both
+supported coding agents, using each CLI's native enforcement point:
+
+- **Claude Code:** permission bypass skips prompts but not hooks, so the
+  runtime generates a Claude settings file (`src/worktree-guard.cts`, passed
+  as `--settings`) that installs `bin/worktree-guard-hook.cjs` as a fail-closed
+  `PreToolUse` hook.
+- **Codex:** the runtime passes a one-off native permission profile with
+  `--ask-for-approval never`. Codex's OS sandbox grants read/write access only
+  to the allowed roots and denies the surrounding multi-session workspace.
+  `--ignore-user-config` and an untrusted project-config override prevent a
+  user or checked-in legacy `sandbox_mode` from silently disabling the
+  generated profile; Codex authentication still comes from `CODEX_HOME`, and
+  repository instructions such as `AGENTS.md` still load.
+
+The resulting boundary is:
+
+- **File tools** (`Read`/`Write`/`Edit`/`Glob`/`Grep`/...) may only touch the
+  session worktree, the project's shared bare repo, temp dirs, and any
+  `NAVARCH_GUARD_EXTRA_ROOTS`. Read-only tools may additionally read standard
+  system prefixes (`/usr`, `/etc`, ...). Symlinks are resolved before the
+  containment check.
+- **Bash commands** are screened lexically: absolute, `~`/`$HOME`, and
+  `..`-traversal path references must land inside the allowed roots or the
+  system prefixes.
+- The **rest of the workspace root** — sibling sessions' worktrees, other
+  projects' bare repos, and the session's own metadata dir (lease-scoped MCP
+  config, the guard files themselves) — is denied outright, so an agent can
+  neither read another agent's checkout nor rewrite its own guard policy.
+
+The Claude hook is a strong guardrail rather than a hard security boundary
+because shell paths are screened lexically. Codex's permission profile is
+enforced by its OS sandbox. For container-grade whole-process isolation use
+`NAVARCH_SANDBOX_MODE=docker`; neither host guard is installed in Docker mode.
+An operator-supplied `--settings` in `NAVARCH_CLAUDE_EXTRA_ARGS`, or an
+explicit Codex permission/sandbox option in `NAVARCH_CODEX_EXTRA_ARGS`, takes
+precedence over the generated policy.
+
+The full mechanism was verified live on 2026-07-19 against a real
+`claude -p --dangerously-skip-permissions --settings <generated file>` run:
+the `PreToolUse` hook fires under permission bypass, an in-worktree Read and
+`git --version` succeed, and a cross-session Read and a Bash redirect into a
+sibling session are both blocked with the guard's message (and nothing lands
+on disk).
 
 ## Choosing an agent (Claude Code vs. Codex)
 
@@ -298,6 +348,12 @@ tests cover:
 - `adapters/codex.cts` — arg construction on both the host path (mocked `spawn`)
   and the docker-exec path (fake `CommandRunner`), and usage/report-text
   attachment from fixed JSONL fixtures (`tests/adapters/codex.test.cts`).
+- `worktree-guard.cts` + `bin/worktree-guard-hook.cjs` — generated settings/
+  config shape, native Codex permission-profile construction, and the hook's
+  containment verdicts (in-worktree vs. sibling session vs. home dir, symlink
+  escapes, Bash path screening, the fail-closed exit-2 protocol run as a real
+  subprocess) (`tests/worktree-guard.test.cts`,
+  `tests/worktree-guard-hook.test.cts`).
 
 Not exercised by unit tests, and needing a real machine per the WP-07 DoD
 ("on a real machine: register → claim a seeded docs task → session runs

package/bin/worktree-guard-hook.cjs

@@ -0,0 +1,312 @@
+#!/usr/bin/env node
+"use strict";
+
+/**
+ * Navarch worktree guard — the PreToolUse hook installed by
+ * src/worktree-guard.cts into every host-mode Claude Code session.
+ *
+ * Multiple sessions run concurrently on one machine (claim-loop.cts), each
+ * confined by convention to its own git worktree
+ * (`<workspaceRoot>/sessions/<sessionId>/repo` — git-worktree.cts). The
+ * adapter launches Claude with --dangerously-skip-permissions (adapters/
+ * claude.cts), which bypasses permission prompts but NOT hooks: Claude Code
+ * runs PreToolUse hooks in every permission mode, so this script is the
+ * enforcement point that keeps an agent from reading or writing another
+ * session's worktree, the operator's home directory, or anything else
+ * unrelated to its task.
+ *
+ * Protocol (Claude Code hooks): the hook receives {tool_name, tool_input,
+ * cwd, ...} as JSON on stdin. Exit 0 allows the tool call; exit 2 blocks it
+ * and feeds stderr back to the model as the reason. Any internal failure
+ * exits 2 as well — a safety harness must fail closed.
+ *
+ * Policy:
+ *  - File tools (Read/Write/Edit/...) may only touch the allowed roots (the
+ *    session worktree, the project's shared bare repo, temp dirs, plus any
+ *    NAVARCH_GUARD_EXTRA_ROOTS). Read-only tools may additionally read
+ *    standard system prefixes (/usr, /etc, ...) so toolchains keep working.
+ *  - Bash commands are screened lexically: absolute, `~`/$HOME, and
+ *    `..`-traversal path references must land inside the allowed roots or
+ *    the system prefixes. This cannot catch every obfuscated escape (shell
+ *    is Turing-complete) — it is a strong guardrail, not a security
+ *    boundary. Operators needing a hard boundary should use
+ *    NAVARCH_SANDBOX_MODE=docker (sandbox.cts).
+ *  - Symlinks are resolved (realpath of the longest existing prefix) before
+ *    the containment check, so `ln -s $HOME escape` doesn't work either.
+ *
+ * This file is plain CommonJS (not .cts) on purpose: it must be runnable by
+ * a bare `node` from both the published package (dist has compiled .cjs
+ * next to bin/) and the source tree (vitest imports it directly), without
+ * depending on the TypeScript build. Node stdlib only.
+ */
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+/**
+ * Prefixes shell commands may reference freely (and read-only file tools may
+ * read): OS/toolchain locations plus shared temp. Everything here is either
+ * world-readable system state or scratch space that no Navarch session owns.
+ * Deliberately absent: /Users, /home, /root, /var (beyond tmp), and the
+ * workspace root — those are exactly what the guard exists to protect.
+ */
+const DEFAULT_SYSTEM_PREFIXES = [
+  "/bin",
+  "/sbin",
+  "/usr",
+  "/lib",
+  "/lib32",
+  "/lib64",
+  "/libx32",
+  "/opt",
+  "/etc",
+  "/private/etc",
+  "/dev",
+  "/proc",
+  "/sys",
+  "/run",
+  // Deliberately NOT the whole /System: /System/Volumes/Data firmlinks the
+  // entire macOS data volume (including /Users), which would be an escape.
+  "/System/Library",
+  "/System/Applications",
+  "/Applications",
+  "/Library/Developer",
+  "/tmp",
+  "/private/tmp",
+  "/var/tmp",
+  "/var/folders",
+  "/private/var/folders",
+  "/nix",
+  "/snap",
+];
+
+/** Path-carrying input fields per guarded file tool (Claude Code tool schemas). */
+const FILE_TOOL_PATH_FIELDS = {
+  Read: ["file_path"],
+  Write: ["file_path"],
+  Edit: ["file_path"],
+  MultiEdit: ["file_path"],
+  NotebookEdit: ["notebook_path"],
+  Glob: ["path"],
+  Grep: ["path"],
+  LS: ["path"],
+};
+
+/** File tools that only read — these may also touch the system prefixes. */
+const READ_ONLY_FILE_TOOLS = new Set(["Read", "Glob", "Grep", "LS"]);
+
+/**
+ * Loads the per-session guard config written by src/worktree-guard.cts:
+ * `{ allowedRoots: string[], deniedRoots?: string[], systemPrefixes?:
+ * string[] }`. Temp roots are appended here (not persisted) so the config
+ * stays portable across OSes.
+ *
+ * Precedence (checkPath below): allowedRoots (this session's own dirs) win,
+ * then deniedRoots (the whole multi-session workspace root — so sibling
+ * sessions and other projects' bare repos stay off-limits even when the
+ * workspace happens to live under a temp or system prefix), then the broad
+ * temp/system allowances.
+ */
+function loadGuardConfig(configPath) {
+  const raw = JSON.parse(fs.readFileSync(configPath, "utf8"));
+  if (!raw || !Array.isArray(raw.allowedRoots) || raw.allowedRoots.length === 0) {
+    throw new Error(`guard config ${configPath} does not declare allowedRoots`);
+  }
+  const canonicalize = (root) => resolveWithRealpath(path.resolve(root));
+  return {
+    allowedRoots: [...new Set(raw.allowedRoots.map(canonicalize))],
+    deniedRoots: [...new Set((raw.deniedRoots ?? []).map(canonicalize))],
+    tempRoots: [...new Set([os.tmpdir(), "/tmp", "/var/tmp"].map(canonicalize))],
+    systemPrefixes:
+      Array.isArray(raw.systemPrefixes) && raw.systemPrefixes.length > 0
+        ? raw.systemPrefixes
+        : DEFAULT_SYSTEM_PREFIXES,
+  };
+}
+
+/**
+ * Containment verdict for one canonicalized absolute path.
+ * `allowSystemPrefixes` is true for read-only file tools and for Bash (whose
+ * commands must keep reaching toolchains under /usr, /etc, ...).
+ */
+function checkPath(resolved, config, allowSystemPrefixes) {
+  if (config.allowedRoots.some((root) => isWithin(root, resolved))) return true;
+  if (config.deniedRoots.some((root) => isWithin(root, resolved))) return false;
+  if (config.tempRoots.some((root) => isWithin(root, resolved))) return true;
+  if (allowSystemPrefixes && config.systemPrefixes.some((root) => isWithin(root, resolved))) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Canonicalizes an absolute path: realpath of the longest existing ancestor
+ * with the non-existent tail re-appended. Resolving through the existing
+ * portion is what defeats symlink escapes; keeping the tail lets the guard
+ * judge not-yet-created files (Write) by where they would actually land.
+ */
+function resolveWithRealpath(absolutePath) {
+  let current = path.normalize(absolutePath);
+  const tail = [];
+  for (;;) {
+    try {
+      const real = fs.realpathSync(current);
+      return tail.length > 0 ? path.join(real, ...tail.reverse()) : real;
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) return path.normalize(absolutePath);
+      tail.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+function isWithin(root, candidate) {
+  return candidate === root || candidate.startsWith(root + path.sep);
+}
+
+/** Expands leading `~`, `~/`, `$HOME`, and `${HOME}` to the real home directory. */
+function expandHome(value) {
+  if (value === "~") return os.homedir();
+  if (value.startsWith("~/")) return path.join(os.homedir(), value.slice(2));
+  if (/^\$\{?HOME\}?($|\/)/.test(value)) return value.replace(/^\$\{?HOME\}?/, os.homedir());
+  return value;
+}
+
+/**
+ * Pulls path-like references out of a shell command: absolute paths,
+ * home-anchored paths (`~...`, `$HOME/...`), and relative `..` traversals.
+ * Lexical by design — see the file header for why this is a guardrail, not
+ * a parser. URLs survive untouched (the char before `//` in `https://` is
+ * `:`, which is not a path delimiter here).
+ */
+function extractBashPathCandidates(command) {
+  const candidates = [];
+  const seen = new Set();
+  const add = (raw) => {
+    const cleaned = raw.replace(/[)\]}"'`,]+$/, "");
+    if (!cleaned || seen.has(cleaned)) return;
+    seen.add(cleaned);
+    candidates.push(cleaned);
+  };
+
+  const absoluteRe = /(?:^|[\s'"`=(<>;|&])(\/[^\s'"`<>;|&)]*)/g;
+  const homeRe = /(?:^|[\s'"`=(<>;|&])((?:~|\$\{?HOME\}?)[^\s'"`<>;|&)]*)/g;
+  let match;
+  while ((match = absoluteRe.exec(command))) add(match[1]);
+  while ((match = homeRe.exec(command))) add(match[1]);
+
+  for (const token of command.split(/[\s'"`;|&<>()]+/)) {
+    if (!token || token.startsWith("-") || token.startsWith("/") || token.startsWith("~")) continue;
+    if (token === ".." || token.startsWith("../") || token.includes("/../") || token.endsWith("/..")) {
+      add(token);
+    }
+  }
+  return candidates;
+}
+
+function denyMessage(toolName, rawPath, resolvedPath, config) {
+  const resolvedNote =
+    resolvedPath && resolvedPath !== rawPath ? ` (resolves to "${resolvedPath}")` : "";
+  return (
+    `Navarch worktree guard blocked this ${toolName} call: "${rawPath}"${resolvedNote} is outside ` +
+    `this session's workspace. This machine runs multiple isolated agent sessions; work only under: ` +
+    `${config.allowedRoots.join(", ")}. Standard system paths (/usr, /etc, /tmp, ...) stay available ` +
+    `to shell commands. Do not attempt to bypass this boundary — if the task genuinely requires that ` +
+    `path, state the limitation in your report instead.`
+  );
+}
+
+/** Screens one Bash command. Returns {allowed} or {allowed:false, reason}. */
+function evaluateBashCommand(command, cwd, config) {
+  // A bare `cd` (or `cd -`) jumps to $HOME / an unknowable previous
+  // directory — both outside the worktree by construction.
+  for (const segment of command.split(/[;&|]+/)) {
+    const trimmed = segment.trim();
+    if (trimmed === "cd" || trimmed === "cd -") {
+      return { allowed: false, reason: denyMessage("Bash", trimmed, os.homedir(), config) };
+    }
+  }
+
+  for (const raw of extractBashPathCandidates(command)) {
+    // `~otheruser/...` — another account's home; nothing there is in scope.
+    if (/^~[^/]/.test(raw)) {
+      return { allowed: false, reason: denyMessage("Bash", raw, "", config) };
+    }
+    const resolved = resolveWithRealpath(path.resolve(cwd, expandHome(raw)));
+    if (!checkPath(resolved, config, true)) {
+      return { allowed: false, reason: denyMessage("Bash", raw, resolved, config) };
+    }
+  }
+  return { allowed: true };
+}
+
+/**
+ * Evaluates one PreToolUse payload. Guarded file tools and Bash are checked;
+ * every other tool (MCP platform tools, WebFetch, Task, ...) is allowed —
+ * the settings matcher (src/worktree-guard.cts) shouldn't even route them
+ * here, so this is belt-and-braces.
+ */
+function evaluateToolUse(input, config) {
+  const toolName = typeof input.tool_name === "string" ? input.tool_name : "";
+  const cwd = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
+  const toolInput = input.tool_input && typeof input.tool_input === "object" ? input.tool_input : {};
+
+  const pathFields = FILE_TOOL_PATH_FIELDS[toolName];
+  if (pathFields) {
+    const candidates = [];
+    for (const field of pathFields) {
+      const value = toolInput[field];
+      if (typeof value === "string" && value) candidates.push(value);
+    }
+    // No explicit path (e.g. Glob/Grep default to cwd): judge cwd itself.
+    if (candidates.length === 0) candidates.push(cwd);
+
+    for (const candidate of candidates) {
+      const resolved = resolveWithRealpath(path.resolve(cwd, expandHome(candidate)));
+      if (!checkPath(resolved, config, READ_ONLY_FILE_TOOLS.has(toolName))) {
+        return { allowed: false, reason: denyMessage(toolName, candidate, resolved, config) };
+      }
+    }
+    return { allowed: true };
+  }
+
+  if (toolName === "Bash") {
+    const command = toolInput.command;
+    if (typeof command !== "string" || !command) return { allowed: true };
+    return evaluateBashCommand(command, cwd, config);
+  }
+
+  return { allowed: true };
+}
+
+function main() {
+  try {
+    const configPath = process.argv[2];
+    if (!configPath) throw new Error("usage: worktree-guard-hook.cjs <guard-config.json>");
+    const config = loadGuardConfig(configPath);
+    const input = JSON.parse(fs.readFileSync(0, "utf8") || "{}");
+    const verdict = evaluateToolUse(input, config);
+    if (verdict.allowed) process.exit(0);
+    process.stderr.write(verdict.reason);
+    process.exit(2);
+  } catch (err) {
+    // Fail closed: a guard that cannot evaluate must not wave the call through.
+    process.stderr.write(`Navarch worktree guard failed closed: ${String(err)}`);
+    process.exit(2);
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  DEFAULT_SYSTEM_PREFIXES,
+  evaluateBashCommand,
+  evaluateToolUse,
+  expandHome,
+  extractBashPathCandidates,
+  isWithin,
+  loadGuardConfig,
+  resolveWithRealpath,
+};

package/dist/adapters/claude.cjs

@@ -37,12 +37,39 @@ const NAVARCH_MCP_ALLOWED_TOOLS = [
  */
 async function runClaudeCodeAdapter(options) {
     const args = ["-p", options.prompt];
+    const hasExplicitPermissionPolicy = options.extraArgs.some((arg) => [
+        "--allowedTools",
+        "--allowed-tools",
+        "--disallowedTools",
+        "--disallowed-tools",
+        "--permission-mode",
+        "--permission-prompt-tool",
+        "--dangerously-skip-permissions",
+    ].includes(arg));
+    // Navarch sessions are unattended: a permission prompt can never be
+    // answered and leaves Claude unable to edit the task's isolated worktree.
+    // The runtime owns that worktree (and, in Docker mode, the surrounding
+    // container), so make the non-interactive session capable of completing
+    // coding tasks by default. Operators can replace this with a narrower
+    // Claude permission policy through NAVARCH_CLAUDE_EXTRA_ARGS.
+    if (!hasExplicitPermissionPolicy) {
+        args.push("--dangerously-skip-permissions");
+    }
+    // The worktree-guard settings file (worktree-guard.cts) installs the
+    // PreToolUse boundary hook. Hooks run even under permission bypass, so this
+    // is what keeps an unattended session inside its own worktree on a machine
+    // running several agents. An operator-supplied --settings (via
+    // NAVARCH_CLAUDE_EXTRA_ARGS) wins — two --settings flags on one invocation
+    // would be ambiguous, and session.cts logs the guard as skipped.
+    if (options.settingsPath && !options.extraArgs.includes("--settings")) {
+        args.push("--settings", options.settingsPath);
+    }
     if (options.mcpConfigPath) {
         args.push("--mcp-config", options.mcpConfigPath);
-        // Headless Claude cannot pause for an interactive permission prompt. The
-        // Navarch server already scopes every call to the authenticated lease and
-        // enforces task/project authorization, so pre-approve exactly its known
-        // tools instead of bypassing Claude permissions globally.
+        // The Navarch server scopes every call to the authenticated lease and
+        // enforces task/project authorization. Keep its tools explicit for
+        // operator-supplied policies and for compatibility with Claude versions
+        // that still inspect allowedTools while permission bypass is active.
         if (!options.extraArgs.includes("--allowedTools") &&
             !options.extraArgs.includes("--allowed-tools")) {
             args.push("--allowedTools", NAVARCH_MCP_ALLOWED_TOOLS.join(","));

package/dist/adapters/codex.cjs

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.codexAdapter = void 0;
 exports.runCodexAdapter = runCodexAdapter;
+exports.hasExplicitPermissionPolicy = hasExplicitPermissionPolicy;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
@@ -29,16 +30,12 @@ const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
  *   per-session JSON is translated into one-off `-c mcp_servers.*` overrides.
  *   Authentication and custom-header values are passed through environment
  *   variables so machine/lease credentials never appear in argv.
- * - Sandboxing/approvals: a real `codex exec` may prompt for
- *   approval/sandbox-escalation on some actions by default; because this
- *   runtime already isolates the session in its own Docker container (or,
- *   in `NAVARCH_SANDBOX_MODE=host`, trusts the host), the intent is to pass
- *   whatever flag disables Codex's own approval gate for a fully
- *   non-interactive run (something like `--full-auto` or
- *   `--dangerously-bypass-approvals-and-sandbox` in published Codex CLI
- *   documentation) — deliberately NOT hardcoded here since getting an
- *   unverified flag wrong could silently change sandboxing behavior; left to
- *   be supplied via NAVARCH_CODEX_EXTRA_ARGS until confirmed.
+ * - Host-mode sessions use a generated native Codex permission profile that
+ *   denies reads and writes outside the session worktree, shared Git dir,
+ *   temp dirs, and operator-approved extra roots. It also uses `--ask-for-
+ *   approval never`, so a boundary violation fails back to the unattended
+ *   agent instead of waiting for input. Explicit permission-policy arguments
+ *   in NAVARCH_CODEX_EXTRA_ARGS replace that generated profile.
  * - `NAVARCH_CODEX_EXTRA_ARGS` (`extraArgs`) wins over the default `--json`
  *   exactly like the Claude adapter's `--output-format` opt-out, so an
  *   operator can fall back to plain-text output (or add the real
@@ -52,6 +49,9 @@ async function runCodexAdapter(options) {
     if (!options.extraArgs.includes("--json")) {
         args.push("--json");
     }
+    if (options.codexGuardArgs && !hasExplicitPermissionPolicy(options.extraArgs)) {
+        args.push(...options.codexGuardArgs);
+    }
     args.push(...options.extraArgs);
     if (options.model)
         args.push("--model", options.model);
@@ -64,6 +64,36 @@ async function runCodexAdapter(options) {
         : await runOnHost(runOptions, args);
     return attachUsage(raw);
 }
+/** Operator policy wins over Navarch's generated host-mode profile. */
+function hasExplicitPermissionPolicy(args) {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if ([
+            "--sandbox",
+            "-s",
+            "--dangerously-bypass-approvals-and-sandbox",
+            "--profile",
+            "-p",
+            "--ignore-user-config",
+        ].includes(arg) ||
+            arg.startsWith("--sandbox=") ||
+            arg.startsWith("-s=")) {
+            return true;
+        }
+        if (arg === "-c" || arg === "--config") {
+            const override = args[index + 1] ?? "";
+            if (/^(sandbox_mode|default_permissions|permissions)(\.|=)/.test(override))
+                return true;
+            index += 1;
+        }
+        else if (arg.startsWith("--config=")) {
+            const override = arg.slice("--config=".length);
+            if (/^(sandbox_mode|default_permissions|permissions)(\.|=)/.test(override))
+                return true;
+        }
+    }
+    return false;
+}
 /** Convert Claude's per-session MCP JSON into Codex one-off TOML overrides. */
 async function codexMcpArgs(path, env) {
     const parsed = JSON.parse(await node_fs_1.promises.readFile(path, "utf8"));

package/dist/config.cjs

@@ -60,5 +60,12 @@ function loadRuntimeConfig(env = process.env) {
         mcpConfigPath: env.NAVARCH_MCP_CONFIG_PATH ?? null,
         sandboxMode,
         dockerImage: env.NAVARCH_DOCKER_IMAGE ?? "node:20-slim",
+        // Multiple sessions share one machine; keeping each agent inside its own
+        // worktree is the safe default, so disabling is the explicit opt-out.
+        worktreeGuard: !["off", "false", "0"].includes(env.NAVARCH_WORKTREE_GUARD ?? ""),
+        guardExtraRoots: (env.NAVARCH_GUARD_EXTRA_ROOTS ?? "")
+            .split(node_path_1.default.delimiter)
+            .map((s) => s.trim())
+            .filter(Boolean),
     };
 }

package/dist/session.cjs

@@ -16,6 +16,7 @@ const mcp_config_cjs_1 = require("./mcp-config.cjs");
 const logger_cjs_1 = require("./logger.cjs");
 const git_worktree_cjs_1 = require("./git-worktree.cjs");
 const github_pr_cjs_1 = require("./github-pr.cjs");
+const worktree_guard_cjs_1 = require("./worktree-guard.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
 const log = (0, logger_cjs_1.createLogger)("session");
@@ -42,7 +43,7 @@ async function runSession(deps, claimed, sessionId) {
     const { lease_id: leaseId, task, context_bundle: bundle } = claimed;
     const execution = bundle.execution ?? {
         profile: task.execution_profile ?? "standard",
-        model: config.agentType === "codex" ? "gpt-5.6" : "best",
+        model: config.agentType === "codex" ? "gpt-5.6-sol" : "best",
         reasoning_effort: "medium",
     };
     const executionReport = {
@@ -183,6 +184,39 @@ async function runSession(deps, claimed, sessionId) {
         await node_fs_1.promises.writeFile(node_path_1.default.join(workDir, MCP_CONFIG_FILENAME), JSON.stringify(mcpConfig, null, 2), "utf8");
         mcpConfigPath = node_path_1.default.join(workDir, MCP_CONFIG_FILENAME);
     }
+    // Worktree boundary guard (worktree-guard.cts): several sessions share this
+    // machine. Host-mode Claude gets a generated PreToolUse hook; host-mode
+    // Codex gets an OS-enforced native permission profile over the same roots.
+    // Docker mode already has a container boundary. NAVARCH_WORKTREE_GUARD=off
+    // opts out for either agent.
+    let claudeSettingsPath = null;
+    let codexGuardArgs;
+    if (config.sandboxMode === "host" && config.worktreeGuard) {
+        if (config.agentType === "claude-code") {
+            if (config.claudeExtraArgs.includes("--settings")) {
+                log.warn("NAVARCH_CLAUDE_EXTRA_ARGS supplies --settings; skipping the generated worktree-guard settings for this session.");
+            }
+            else {
+                const guard = await (0, worktree_guard_cjs_1.prepareWorktreeGuard)({
+                    workDir,
+                    worktreePath: gitWorktree.worktreePath,
+                    repositoryPath: gitWorktree.repositoryPath,
+                    workspaceRoot: config.workspaceRoot,
+                    extraRoots: config.guardExtraRoots,
+                });
+                claudeSettingsPath = guard.settingsPath;
+            }
+        }
+        else {
+            codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
+                workDir,
+                worktreePath: gitWorktree.worktreePath,
+                repositoryPath: gitWorktree.repositoryPath,
+                workspaceRoot: config.workspaceRoot,
+                extraRoots: config.guardExtraRoots,
+            });
+        }
+    }
     try {
         await gitWorktree.prepare();
         if (sandbox) {
@@ -220,6 +254,8 @@ async function runSession(deps, claimed, sessionId) {
                 reasoningEffort: execution.reasoning_effort,
                 timeoutMs: config.sessionTimeoutMs,
                 env: toEnvMap(secrets),
+                settingsPath: claudeSettingsPath,
+                codexGuardArgs,
                 cwd: sandbox ? undefined : gitWorktree.worktreePath,
                 dockerExec: sandbox ? { containerName: sandbox.name, runner: sandbox_cjs_1.nodeCommandRunner } : undefined,
                 signal: activeAbortController.signal,

package/dist/worktree-guard.cjs

@@ -0,0 +1,121 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardHookScriptPath = guardHookScriptPath;
+exports.prepareWorktreeGuard = prepareWorktreeGuard;
+exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = require("node:fs");
+const CODEX_GUARD_PROFILE = "navarch-worktree";
+/**
+ * Tools the hook screens. Everything else — the lease-scoped Navarch MCP
+ * tools, WebFetch, Task, ... — carries no direct filesystem path and passes
+ * through unmatched.
+ */
+const GUARDED_TOOL_MATCHER = "^(Read|Write|Edit|MultiEdit|NotebookEdit|Glob|Grep|LS|Bash)$";
+/**
+ * The hook ships as plain CommonJS in bin/ (see its header for why), which
+ * sits one level above this module both in the source tree (src/) and in the
+ * published package (dist/), so __dirname-relative resolution works in both.
+ */
+function guardHookScriptPath() {
+    return node_path_1.default.join(__dirname, "..", "bin", "worktree-guard-hook.cjs");
+}
+/**
+ * Writes the per-session guard config + Claude settings file into workDir and
+ * returns their paths. The settings file is passed to the CLI as `--settings`
+ * by adapters/claude.cts.
+ */
+async function prepareWorktreeGuard(options) {
+    const hookScriptPath = guardHookScriptPath();
+    const configPath = node_path_1.default.join(options.workDir, "worktree-guard.json");
+    const settingsPath = node_path_1.default.join(options.workDir, "claude-settings.json");
+    const allowedRoots = [
+        options.worktreePath,
+        options.repositoryPath,
+        ...(options.extraRoots ?? []),
+    ];
+    const deniedRoots = [options.workspaceRoot];
+    await node_fs_1.promises.writeFile(configPath, JSON.stringify({ allowedRoots, deniedRoots }, null, 2), "utf8");
+    // process.execPath rather than a bare `node`: the hook must run with the
+    // same interpreter as the runtime regardless of the agent's PATH.
+    const command = [process.execPath, hookScriptPath, configPath].map(shellQuote).join(" ");
+    const settings = {
+        hooks: {
+            PreToolUse: [
+                {
+                    matcher: GUARDED_TOOL_MATCHER,
+                    hooks: [{ type: "command", command }],
+                },
+            ],
+        },
+    };
+    await node_fs_1.promises.writeFile(settingsPath, JSON.stringify(settings, null, 2), "utf8");
+    return { settingsPath, configPath, hookScriptPath };
+}
+/**
+ * Builds one-off Codex permission-profile arguments for a host session.
+ *
+ * `--ignore-user-config` is deliberate: a sandbox_mode in any loaded user
+ * config makes Codex ignore permission profiles, which would silently discard
+ * this boundary. Authentication still comes from CODEX_HOME. The profile
+ * grants only the runtime paths common tools need, the session worktree, the
+ * shared Git directory, temp space, and operator-approved extra roots. The
+ * surrounding Navarch workspace is denied, then the more-specific current
+ * worktree/repository grants reopen only this session's paths. The worktree
+ * is marked untrusted for configuration purposes so a checked-in legacy
+ * sandbox_mode cannot disable the generated permission profile; repository
+ * instructions such as AGENTS.md still load normally.
+ */
+function codexWorktreeGuardArgs(options) {
+    const filesystem = {
+        ":minimal": "read",
+        ":tmpdir": "write",
+        ":slash_tmp": "write",
+        [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
+        [node_path_1.default.resolve(options.worktreePath)]: "write",
+        [node_path_1.default.resolve(options.repositoryPath)]: "write",
+    };
+    for (const root of options.extraRoots ?? []) {
+        const resolved = node_path_1.default.resolve(root);
+        // Match the Claude hook's denied-root precedence: an extra root cannot
+        // reopen sibling sessions or metadata inside the Navarch workspace.
+        if (isPathInside(resolved, node_path_1.default.resolve(options.workspaceRoot)))
+            continue;
+        filesystem[resolved] = "write";
+    }
+    return [
+        "--ignore-user-config",
+        "--ask-for-approval",
+        "never",
+        "-c",
+        `projects.${tomlString(node_path_1.default.resolve(options.worktreePath))}.trust_level="untrusted"`,
+        "-c",
+        `default_permissions=${tomlString(CODEX_GUARD_PROFILE)}`,
+        "-c",
+        `permissions.${CODEX_GUARD_PROFILE}.filesystem=${tomlInlineTable(filesystem)}`,
+        // Navarch coding tasks must be able to fetch dependencies and push their
+        // branch. The profile still constrains filesystem access independently.
+        "-c",
+        `permissions.${CODEX_GUARD_PROFILE}.network.enabled=true`,
+    ];
+}
+function isPathInside(candidate, root) {
+    const relative = node_path_1.default.relative(root, candidate);
+    return relative === "" || (!relative.startsWith("..") && !node_path_1.default.isAbsolute(relative));
+}
+function tomlInlineTable(table) {
+    return `{${Object.entries(table)
+        .map(([key, value]) => typeof value === "string"
+        ? `${tomlString(key)}=${tomlString(value)}`
+        : `${tomlString(key)}=${tomlInlineTable(value)}`)
+        .join(",")}}`;
+}
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Navarch machine-side session manager: registers a machine, claims tasks from the control-plane dispatcher, runs them via the Claude Code or Codex adapter, and reports results back.",
   "type": "commonjs",
   "license": "MIT",