@sagentlab/navarch-runtime 0.1.5 → 0.1.7

package/dist/update-installer.cjs

@@ -0,0 +1,164 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateUpdateDirective = validateUpdateDirective;
+exports.stageRuntimeUpdate = stageRuntimeUpdate;
+exports.writePendingUpdate = writePendingUpdate;
+exports.readPendingUpdate = readPendingUpdate;
+exports.clearPendingUpdate = clearPendingUpdate;
+exports.writeActiveRuntime = writeActiveRuntime;
+exports.readActiveRuntime = readActiveRuntime;
+exports.assertSafePendingUpdate = assertSafePendingUpdate;
+exports.verifyManagedRuntime = verifyManagedRuntime;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+const PACKAGE_NAME = "@sagentlab/navarch-runtime";
+const EXACT_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/;
+const SHA512_INTEGRITY = /^sha512-[A-Za-z0-9+/]+={0,2}$/;
+const defaultRunner = async (file, args) => {
+    const result = await execFileAsync(file, args, { maxBuffer: 10 * 1024 * 1024 });
+    return { stdout: result.stdout, stderr: result.stderr };
+};
+function validateUpdateDirective(directive) {
+    if (!EXACT_SEMVER.test(directive.target_version)) {
+        throw new Error(`Invalid runtime target version: ${directive.target_version}`);
+    }
+    if (!SHA512_INTEGRITY.test(directive.integrity)) {
+        throw new Error("Runtime update is missing a valid SHA-512 integrity value.");
+    }
+    if (!directive.rollout_id || directive.rollout_id.length > 128) {
+        throw new Error("Runtime update has an invalid rollout id.");
+    }
+}
+async function verifyInstalledPackage(packageDir, version, integrity) {
+    const manifest = JSON.parse(await node_fs_1.promises.readFile(node_path_1.default.join(packageDir, "package.json"), "utf8"));
+    if (manifest.name !== PACKAGE_NAME || manifest.version !== version) {
+        throw new Error("Staged runtime package identity did not match the requested release.");
+    }
+    const recordedIntegrity = (await node_fs_1.promises.readFile(node_path_1.default.join(packageDir, ".navarch-integrity"), "utf8")).trim();
+    if (recordedIntegrity !== integrity) {
+        throw new Error("Staged runtime integrity did not match the release directive.");
+    }
+    const binPath = node_path_1.default.join(packageDir, "bin", "navarch.cjs");
+    await node_fs_1.promises.access(binPath);
+    return { version, integrity, bin_path: binPath };
+}
+/** Downloads and verifies an exact immutable npm release without running package scripts. */
+async function stageRuntimeUpdate(configDir, directive, runner = defaultRunner) {
+    validateUpdateDirective(directive);
+    const versionsDir = node_path_1.default.join(configDir, "versions");
+    const targetDir = node_path_1.default.join(versionsDir, directive.target_version);
+    await node_fs_1.promises.mkdir(versionsDir, { recursive: true, mode: 0o700 });
+    try {
+        const staged = await verifyInstalledPackage(targetDir, directive.target_version, directive.integrity);
+        await runner(process.execPath, [staged.bin_path, "--help"]);
+        return staged;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        await node_fs_1.promises.rm(targetDir, { recursive: true, force: true });
+    }
+    const stagingDir = node_path_1.default.join(versionsDir, `.staging-${(0, node_crypto_1.randomUUID)()}`);
+    const installDir = node_path_1.default.join(stagingDir, "install");
+    await node_fs_1.promises.mkdir(installDir, { recursive: true, mode: 0o700 });
+    try {
+        const packed = await runner("npm", [
+            "pack",
+            `${PACKAGE_NAME}@${directive.target_version}`,
+            "--json",
+            "--ignore-scripts",
+            "--pack-destination",
+            stagingDir,
+        ]);
+        const packResult = JSON.parse(packed.stdout);
+        const artifact = packResult[0];
+        if (!artifact ||
+            typeof artifact.filename !== "string" ||
+            artifact.integrity !== directive.integrity) {
+            throw new Error("Downloaded runtime tarball failed its release integrity check.");
+        }
+        const tarballPath = node_path_1.default.join(stagingDir, node_path_1.default.basename(artifact.filename));
+        await runner("npm", [
+            "install",
+            "--prefix",
+            installDir,
+            "--ignore-scripts",
+            "--omit=dev",
+            "--no-audit",
+            "--no-fund",
+            "--package-lock=false",
+            tarballPath,
+        ]);
+        const installedPackage = node_path_1.default.join(installDir, "node_modules", "@sagentlab", "navarch-runtime");
+        await node_fs_1.promises.writeFile(node_path_1.default.join(installedPackage, ".navarch-integrity"), `${directive.integrity}\n`, { mode: 0o600 });
+        await node_fs_1.promises.rename(installedPackage, targetDir);
+        const staged = await verifyInstalledPackage(targetDir, directive.target_version, directive.integrity);
+        await runner(process.execPath, [staged.bin_path, "--help"]);
+        return staged;
+    }
+    finally {
+        await node_fs_1.promises.rm(stagingDir, { recursive: true, force: true });
+    }
+}
+function pendingPath(configDir) {
+    return node_path_1.default.join(configDir, "pending-update.json");
+}
+function activePath(configDir) {
+    return node_path_1.default.join(configDir, "active-runtime.json");
+}
+async function writePendingUpdate(configDir, staged, rolloutId) {
+    const pending = { ...staged, rollout_id: rolloutId };
+    const tempPath = `${pendingPath(configDir)}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+    await node_fs_1.promises.writeFile(tempPath, `${JSON.stringify(pending, null, 2)}\n`, { mode: 0o600 });
+    await node_fs_1.promises.rename(tempPath, pendingPath(configDir));
+}
+async function readPendingUpdate(configDir) {
+    try {
+        return JSON.parse(await node_fs_1.promises.readFile(pendingPath(configDir), "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function clearPendingUpdate(configDir) {
+    await node_fs_1.promises.rm(pendingPath(configDir), { force: true });
+}
+async function writeActiveRuntime(configDir, pending) {
+    const active = { ...pending, activated_at: new Date().toISOString() };
+    const tempPath = `${activePath(configDir)}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+    await node_fs_1.promises.writeFile(tempPath, `${JSON.stringify(active, null, 2)}\n`, { mode: 0o600 });
+    await node_fs_1.promises.rename(tempPath, activePath(configDir));
+}
+async function readActiveRuntime(configDir) {
+    try {
+        return JSON.parse(await node_fs_1.promises.readFile(activePath(configDir), "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function assertSafePendingUpdate(configDir, pending) {
+    if (!EXACT_SEMVER.test(pending.version))
+        throw new Error("Pending update has an invalid version.");
+    const expectedBin = node_path_1.default.resolve(configDir, "versions", pending.version, "bin", "navarch.cjs");
+    if (node_path_1.default.resolve(pending.bin_path) !== expectedBin) {
+        throw new Error("Pending update executable is outside the managed versions directory.");
+    }
+}
+/** Re-verifies a persisted managed pointer before the supervisor executes it. */
+async function verifyManagedRuntime(configDir, runtime) {
+    assertSafePendingUpdate(configDir, runtime);
+    const packageDir = node_path_1.default.resolve(configDir, "versions", runtime.version);
+    return verifyInstalledPackage(packageDir, runtime.version, runtime.integrity);
+}

package/dist/version.cjs

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPDATER_PROTOCOL_VERSION = exports.RUNTIME_VERSION = void 0;
+// package.json is always included in an npm package, even though the runtime's
+// explicit `files` allowlist only names dist/bin/README.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const packageJson = require("../package.json");
+exports.RUNTIME_VERSION = typeof packageJson.version === "string" ? packageJson.version : "0.0.0-unknown";
+exports.UPDATER_PROTOCOL_VERSION = 1;

package/dist/worktree-guard.cjs

@@ -0,0 +1,125 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardHookScriptPath = guardHookScriptPath;
+exports.prepareWorktreeGuard = prepareWorktreeGuard;
+exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = require("node:fs");
+const CODEX_GUARD_PROFILE = "navarch-worktree";
+/**
+ * Tools the hook screens. Everything else — the lease-scoped Navarch MCP
+ * tools, WebFetch, Task, ... — carries no direct filesystem path and passes
+ * through unmatched.
+ */
+const GUARDED_TOOL_MATCHER = "^(Read|Write|Edit|MultiEdit|NotebookEdit|Glob|Grep|LS|Bash)$";
+/**
+ * The hook ships as plain CommonJS in bin/ (see its header for why), which
+ * sits one level above this module both in the source tree (src/) and in the
+ * published package (dist/), so __dirname-relative resolution works in both.
+ */
+function guardHookScriptPath() {
+    return node_path_1.default.join(__dirname, "..", "bin", "worktree-guard-hook.cjs");
+}
+/**
+ * Writes the per-session guard config + Claude settings file into workDir and
+ * returns their paths. The settings file is passed to the CLI as `--settings`
+ * by adapters/claude.cts.
+ */
+async function prepareWorktreeGuard(options) {
+    const hookScriptPath = guardHookScriptPath();
+    const configPath = node_path_1.default.join(options.workDir, "worktree-guard.json");
+    const settingsPath = node_path_1.default.join(options.workDir, "claude-settings.json");
+    const allowedRoots = [
+        options.worktreePath,
+        options.repositoryPath,
+        ...(options.extraRoots ?? []),
+    ];
+    const deniedRoots = [options.workspaceRoot];
+    await node_fs_1.promises.writeFile(configPath, JSON.stringify({ allowedRoots, deniedRoots }, null, 2), "utf8");
+    // process.execPath rather than a bare `node`: the hook must run with the
+    // same interpreter as the runtime regardless of the agent's PATH.
+    const command = [process.execPath, hookScriptPath, configPath].map(shellQuote).join(" ");
+    const settings = {
+        hooks: {
+            PreToolUse: [
+                {
+                    matcher: GUARDED_TOOL_MATCHER,
+                    hooks: [{ type: "command", command }],
+                },
+            ],
+        },
+    };
+    await node_fs_1.promises.writeFile(settingsPath, JSON.stringify(settings, null, 2), "utf8");
+    return { settingsPath, configPath, hookScriptPath };
+}
+/**
+ * Builds one-off Codex permission-profile arguments for a host session.
+ *
+ * `--ignore-user-config` is deliberate: a sandbox_mode in any loaded user
+ * config makes Codex ignore permission profiles, which would silently discard
+ * this boundary. Authentication still comes from CODEX_HOME. The profile
+ * grants only the runtime paths common tools need, the session worktree, the
+ * shared Git directory, temp space, and operator-approved extra roots. The
+ * surrounding Navarch workspace is denied, then the more-specific current
+ * worktree/repository grants reopen only this session's paths. The worktree
+ * is marked untrusted for configuration purposes so a checked-in legacy
+ * sandbox_mode cannot disable the generated permission profile; repository
+ * instructions such as AGENTS.md still load normally.
+ */
+function codexWorktreeGuardArgs(options) {
+    const filesystem = {
+        ":minimal": "read",
+        ":tmpdir": "write",
+        ":slash_tmp": "write",
+        [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
+        [node_path_1.default.resolve(options.worktreePath)]: "write",
+        [node_path_1.default.resolve(options.repositoryPath)]: "write",
+    };
+    for (const root of options.extraRoots ?? []) {
+        const resolved = node_path_1.default.resolve(root);
+        // Match the Claude hook's denied-root precedence: an extra root cannot
+        // reopen sibling sessions or metadata inside the Navarch workspace.
+        if (isPathInside(resolved, node_path_1.default.resolve(options.workspaceRoot)))
+            continue;
+        filesystem[resolved] = "write";
+    }
+    return [
+        "--ignore-user-config",
+        // Keep approvals interactive at the policy layer, but route them to
+        // Codex's automatic reviewer because `codex exec` has no human available.
+        "-c",
+        'approval_policy="on-request"',
+        "-c",
+        'approvals_reviewer="auto_review"',
+        "-c",
+        `projects.${tomlString(node_path_1.default.resolve(options.worktreePath))}.trust_level="untrusted"`,
+        "-c",
+        `default_permissions=${tomlString(CODEX_GUARD_PROFILE)}`,
+        "-c",
+        `permissions.${CODEX_GUARD_PROFILE}.filesystem=${tomlInlineTable(filesystem)}`,
+        // Navarch coding tasks must be able to fetch dependencies and push their
+        // branch. The profile still constrains filesystem access independently.
+        "-c",
+        `permissions.${CODEX_GUARD_PROFILE}.network.enabled=true`,
+    ];
+}
+function isPathInside(candidate, root) {
+    const relative = node_path_1.default.relative(root, candidate);
+    return relative === "" || (!relative.startsWith("..") && !node_path_1.default.isAbsolute(relative));
+}
+function tomlInlineTable(table) {
+    return `{${Object.entries(table)
+        .map(([key, value]) => typeof value === "string"
+        ? `${tomlString(key)}=${tomlString(value)}`
+        : `${tomlString(key)}=${tomlInlineTable(value)}`)
+        .join(",")}}`;
+}
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Navarch machine-side session manager: registers a machine, claims tasks from the control-plane dispatcher, runs them via the Claude Code or Codex adapter, and reports results back.",
   "type": "commonjs",
   "license": "MIT",
@@ -38,6 +38,7 @@
     "test:watch": "vitest",
     "prepublishOnly": "npm run build && npm test",
     "start": "node bin/navarch.cjs start",
+    "supervise": "node bin/navarch.cjs supervise",
     "register": "node bin/navarch.cjs register",
     "connect": "node bin/navarch.cjs connect",
     "doctor": "node bin/navarch.cjs doctor"