@sagentlab/navarch-runtime 0.1.51 → 0.1.53

package/README.md

@@ -152,10 +152,10 @@ The from-source flow — `git clone` + `./install.sh` + `node bin/navarch.cjs
 
 | Command | Purpose |
 |---|---|
-| `register --token <t> --name <n> [--agent claude-code\|codex\|gemini\|opencode\|acp] […]` | Registers this machine, saves its local agent choice, and prints the token once. |
-| `connect --token <t> --name <n> [--agent claude-code\|codex\|gemini\|opencode\|acp] [--project <id>] […]` | Connects this machine to one project, saves its local agent choice, and prints the token once. |
-| `start [--agent claude-code\|codex\|gemini\|opencode\|acp]` | Runs the daemon. A start-time agent choice overrides the saved choice. |
-| `supervise [--agent claude-code\|codex\|gemini\|opencode\|acp]` | Runs the daemon under the update supervisor, enabling drain-safe automatic updates and rollback. |
+| `register --token <t> --name <n> [--agent claude-code\|codex\|gemini\|opencode\|acp\|qoder] […]` | Registers this machine, saves its local agent choice, and prints the token once. |
+| `connect --token <t> --name <n> [--agent claude-code\|codex\|gemini\|opencode\|acp\|qoder] [--project <id>] […]` | Connects this machine to one project, saves its local agent choice, and prints the token once. |
+| `start [--agent claude-code\|codex\|gemini\|opencode\|acp\|qoder]` | Runs the daemon. A start-time agent choice overrides the saved choice. |
+| `supervise [--agent claude-code\|codex\|gemini\|opencode\|acp\|qoder]` | Runs the daemon under the update supervisor, enabling drain-safe automatic updates and rollback. |
 | `doctor` | Prints resolved config + Docker/registration status; no side effects. |
 
 ### Running multiple agents on one machine
@@ -368,8 +368,8 @@ unchanged across the deployment.
 | `NAVARCH_SANDBOX_PROFILE` | `trusted-development` | Named security profile for Docker sessions (`src/sandbox-profile.cts`): `trusted-development` (image-default user, uncapped, open egress), `untrusted-code` (non-root, 2 CPU / 4g / 512 PIDs, deny-by-default egress, read-only shared git), `elevated-verification` (non-root, 4 CPU / 8g / 2048 PIDs, egress limited to GitHub plus package registries). The default is the exact pre-profile flag set. |
 | `NAVARCH_SANDBOX_EGRESS_NETWORK` | _(unset)_ | Docker network that enforces a profile's egress allowlist. Docker cannot filter by domain itself, so an allowlist profile without this fails closed to `--network=none` and records the denial. |
 | `NAVARCH_DOCKER_IMAGE` | `ghcr.io/sagentlab/navarch-sandbox-agent:0.1.0` | Version-pinned per-session image with Node 20, git, GitHub CLI, ripgrep, jq, SSH, and Claude Code 2.1.218. Override with an image tag or digest you control. |
-| `NAVARCH_AGENT` | saved choice, then `claude-code` | Local choice of agent adapter: `claude-code`, `codex`, `gemini`, `opencode`, or `acp`. Overrides the choice saved by `connect`/`register`; `start --agent` has highest priority. |
-| `NAVARCH_RUNTIMES` | selected `NAVARCH_AGENT` | Comma list of installed/authenticated adapters advertised to dispatch. The control plane chooses among these per project/task. |
+| `NAVARCH_AGENT` | saved choice, then `claude-code` | Local choice of agent adapter: `claude-code`, `codex`, `gemini`, `opencode`, `acp`, or `qoder`. Overrides the choice saved by `connect`/`register`; `start --agent` has highest priority. |
+| `NAVARCH_RUNTIMES` | resolved local agent choice | Comma list of installed/authenticated adapters advertised to dispatch. The control plane chooses among these per project/task. |
 | `NAVARCH_UPDATE_CHANNEL` | `stable` | Release channel advertised by the worker (`stable` or `canary`); the server-managed machine channel remains authoritative. |
 | `NAVARCH_AUTO_UPDATE` | on under `supervise` | Set `off`, `false`, or `0` to report releases without staging or activating them. Automatic activation is always off under plain `start`. |
 | `NAVARCH_CLAUDE_BIN` | `claude` | Path/name of the Claude Code CLI binary. |
@@ -382,6 +382,8 @@ unchanged across the deployment.
 | `NAVARCH_OPENCODE_EXTRA_ARGS` | — | Comma list of extra CLI args appended after `run`, the prompt, and the generated `--format json` argument. Explicit `--format`, `--model`, or `--variant` values replace the corresponding per-session default. |
 | `NAVARCH_ACP_BIN` | `dsh` | Path/name of an Agent Client Protocol v1 stdio server. DeepSeek Harness is the default implementation. |
 | `NAVARCH_ACP_EXTRA_ARGS` | `--profile,acp` | Comma list of arguments used to start the ACP server. Override this together with `NAVARCH_ACP_BIN` for another ACP-compatible coding agent. |
+| `NAVARCH_QODER_BIN` | `qoder` | Path/name of the Qoder CLI binary. |
+| `NAVARCH_QODER_EXTRA_ARGS` | — | Comma list of extra CLI args appended after the unattended defaults (`--setting-sources`, `--permission-mode auto`, `--output-format json`). An explicit `--output-format`, `--permission-mode`, `--settings`, `--model`, or `--reasoning-effort` here replaces the per-session default. Qoder selects its own account models; pin one via `--model` here or `connect --model` to override. |
 | `NAVARCH_MCP_CONFIG_PATH` | — | Path to the platform MCP config passed as `--mcp-config`. |
 | `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable it for every runtime on the machine — required to run OpenCode on the host. |
 | `NAVARCH_GUARD_EXTRA_ROOTS` | — | `path.delimiter`-separated (`:` on POSIX) extra directories the worktree guard allows beyond the session worktree, shared bare repo, and temp dirs. |
@@ -514,10 +516,15 @@ export NAVARCH_AGENT=opencode
 # Override NAVARCH_ACP_BIN / NAVARCH_ACP_EXTRA_ARGS for another ACP v1 server.
 export NAVARCH_AGENT=acp
 
+# Qoder — requires an authenticated `qoder` CLI (or NAVARCH_QODER_BIN pointing
+# at it). Model selection is account-owned; NAVARCH_QODER_EXTRA_ARGS or
+# `connect --model` can pin one explicitly.
+export NAVARCH_AGENT=qoder
+
 # Advanced compatibility mode: advertise every installed adapter. On a guarded
 # host, `opencode` is dropped from this list (see the boundary notes above);
 # the rest are advertised as written.
-export NAVARCH_RUNTIMES=claude-code,codex,gemini,opencode,acp
+export NAVARCH_RUNTIMES=claude-code,codex,gemini,opencode,acp,qoder
 ```
 
 For the legacy single-runtime setting, priority is `start --agent` →
@@ -601,6 +608,16 @@ to OpenCode's remote-server config with OAuth disabled and environment-backed
 headers. Missing accounting fields stay absent rather than becoming a
 fabricated zero.
 
+OpenCode also runs with `--print-logs --log-level ERROR` by default (see its
+[CLI flags](https://opencode.ai/docs/cli/#global-flags)), so provider errors
+that are missing from assistant messages still reach the runtime. A rate or
+usage limit in a provider error event or stream-error log stops the host
+process or Docker container immediately. The runtime checkpoints local work,
+records the error, and releases the lease with a failed session outcome.
+Pending guidance does not restart that session. New claims on this machine
+pause until the reported reset time (including relative resets such as
+“in 23 days”), or for 15 minutes when no reset time is available.
+
 The ACP adapter speaks the standard [Agent Client Protocol](https://agentclientprotocol.com)
 v1 JSON-RPC transport over stdio. It creates one protocol session in the task
 worktree, converts Navarch's HTTP/stdio MCP entries, consumes semantic message,
@@ -632,6 +649,7 @@ cli.cts
                     - geminiAdapter     (adapters/gemini.cts) — `gemini --prompt <prompt> --output-format stream-json`
                     - openCodeAdapter   (adapters/opencode.cts) — `opencode run <prompt> --format json`
                     - acpAdapter        (adapters/acp.cts) — ACP v1 JSON-RPC/stdio; defaults to `dsh --profile acp`
+                    - qoderAdapter      (adapters/qoder.cts) — `qoder -p <prompt> --output-format json`
                   heartbeating the lease every NAVARCH_LEASE_HEARTBEAT_INTERVAL_MS throughout either;
                   a failed heartbeat aborts the run (kills the process) and marks the outcome as lease-lost
                5. mapExitCondition (exit-conditions.cts) → redact.cts scrubs the transcript → upload.cts PUTs it
@@ -680,7 +698,7 @@ contract used by `api.cts`, including:
    distinct from the per-lease heartbeat, needed because `machines.last_heartbeat_at`
    /`status` must update even when no task is claimed.
 3. **`POST /api/dispatch/:leaseId/transcript-upload-url`** — a signed
-   Supabase Storage upload URL for the session's redacted transcript. The
+   R2 upload URL for the session's redacted transcript. The
    bucket is private; the legacy `public_url` response field is only an
    attested locator returned at completion, not an anonymous read URL.
 
@@ -782,7 +800,7 @@ secrets absent from disk after exit"):
   already-reassigned lease) — `session.cts` aborts the running adapter
   process and still attempts a best-effort `complete()` call, which the
   real server may reject; that path is untested against real semantics.
-- Transcript upload against a real signed Supabase Storage URL.
+- Transcript upload against a real signed R2 URL.
 - The end-to-end "Connect an agent to a project" flow against a real
   Supabase instance: an owner minting a token from `ConnectAgentPanel`
   (or the onboarding wizard's Agent step), `navarch-runtime connect`

package/dist/adapter-capacity.cjs

@@ -14,9 +14,9 @@ const MAX_RESET_SEARCH_MINUTES = 48 * 60;
 function detectAdapterCapacityLimit(result, nowMs = Date.now()) {
     const parsed = (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stdout) ??
         (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stderr);
-    if (parsed?.api_error_status !== 429)
+    if (!result.capacityError && parsed?.api_error_status !== 429)
         return null;
-    const detail = parsed.result ?? "";
+    const detail = result.capacityError ?? parsed?.result ?? "";
     if (!/\b(?:session|usage|rate)\s+limit\b|\btoo many requests\b/i.test(detail)) {
         return null;
     }
@@ -32,6 +32,13 @@ function detectAdapterCapacityLimit(result, nowMs = Date.now()) {
  * the platform's IANA timezone database.
  */
 function parseResetTime(detail, nowMs) {
+    const relative = detail.match(/\bresets?\s+in\s+(\d+(?:\.\d+)?)\s*(seconds?|minutes?|hours?|days?)\b/i);
+    if (relative) {
+        const units = { second: 1000, minute: 60_000, hour: 3_600_000, day: 86_400_000 };
+        const duration = Number(relative[1]) * units[relative[2].toLowerCase().replace(/s$/, "")];
+        if (Number.isFinite(duration) && duration > 0)
+            return nowMs + duration + RESET_GRACE_MS;
+    }
     const match = detail.match(/\bresets?\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(([^)]+)\)/i);
     if (!match)
         return null;

package/dist/adapters/index.cjs

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runAcpAdapter = exports.acpAdapter = exports.runPiAdapter = exports.piAdapter = exports.runOpenCodeAdapter = exports.openCodeAdapter = exports.runGeminiAdapter = exports.geminiAdapter = exports.runCodexAdapter = exports.codexAdapter = exports.runClaudeCodeAdapter = exports.claudeCodeAdapter = void 0;
+exports.runQoderAdapter = exports.qoderAdapter = exports.runAcpAdapter = exports.acpAdapter = exports.runPiAdapter = exports.piAdapter = exports.runOpenCodeAdapter = exports.openCodeAdapter = exports.runGeminiAdapter = exports.geminiAdapter = exports.runCodexAdapter = exports.codexAdapter = exports.runClaudeCodeAdapter = exports.claudeCodeAdapter = void 0;
 exports.selectAdapter = selectAdapter;
 const claude_cjs_1 = require("./claude.cjs");
 Object.defineProperty(exports, "claudeCodeAdapter", { enumerable: true, get: function () { return claude_cjs_1.claudeCodeAdapter; } });
@@ -20,6 +20,9 @@ Object.defineProperty(exports, "runPiAdapter", { enumerable: true, get: function
 const acp_cjs_1 = require("./acp.cjs");
 Object.defineProperty(exports, "acpAdapter", { enumerable: true, get: function () { return acp_cjs_1.acpAdapter; } });
 Object.defineProperty(exports, "runAcpAdapter", { enumerable: true, get: function () { return acp_cjs_1.runAcpAdapter; } });
+const qoder_cjs_1 = require("./qoder.cjs");
+Object.defineProperty(exports, "qoderAdapter", { enumerable: true, get: function () { return qoder_cjs_1.qoderAdapter; } });
+Object.defineProperty(exports, "runQoderAdapter", { enumerable: true, get: function () { return qoder_cjs_1.runQoderAdapter; } });
 /**
  * Picks the AgentAdapter (adapters/types.cts) session.cts should run a
  * session with, keyed off config.cts's `agentType` (NAVARCH_AGENT). This is
@@ -37,6 +40,8 @@ function selectAdapter(agentType) {
             return opencode_cjs_1.openCodeAdapter;
         case "acp":
             return acp_cjs_1.acpAdapter;
+        case "qoder":
+            return qoder_cjs_1.qoderAdapter;
         case "claude-code":
             return claude_cjs_1.claudeCodeAdapter;
         case "pi":

package/dist/adapters/opencode.cjs

@@ -7,10 +7,10 @@ const node_fs_1 = require("node:fs");
 const config_cjs_1 = require("../config.cjs");
 const kill_agent_cjs_1 = require("../kill-agent.cjs");
 /**
- * Headless OpenCode adapter, fixture-pinned to the OpenCode 1.18 JSON/config
- * contract:
+ * Headless OpenCode adapter, fixture-pinned to the OpenCode JSON/config
+ * contract shared by V1 and V2 (verified against 2.0.6):
  *
- *   opencode run "<prompt>" --format json [--model provider/model]
+ *   opencode run "<prompt>" --format json [--model provider/model[#variant]]
  *
  * OpenCode merges configuration from several machine and project locations,
  * so each Navarch session gets an isolated XDG/config directory, disables
@@ -32,14 +32,21 @@ async function runOpenCodeAdapter(options) {
     const env = { ...options.env };
     await prepareOpenCodeConfig(options.mcpConfigPath, env);
     const args = ["run", options.prompt];
+    // Provider failures may only appear in logs, absent from assistant events.
+    if (!hasArg(options.extraArgs, "--print-logs"))
+        args.push("--print-logs");
+    if (!hasArg(options.extraArgs, "--log-level"))
+        args.push("--log-level", "ERROR");
     if (!hasArg(options.extraArgs, "--format"))
         args.push("--format", "json");
     args.push(...options.extraArgs);
     if (options.model && options.model !== "default" && !hasArg(options.extraArgs, "--model", "-m")) {
-        args.push("--model", options.model);
-    }
-    if (options.reasoningEffort && !hasArg(options.extraArgs, "--variant")) {
-        args.push("--variant", options.reasoningEffort);
+        // OpenCode V2 folds the reasoning variant into the model reference
+        // (`provider/model#variant`) and hard-fails on a variant the model does
+        // not advertise. The claim route clamps the effort to the model's
+        // advertised variants, so a present value is always valid; absent means
+        // use the model's own default.
+        args.push("--model", options.reasoningEffort ? `${options.model}#${options.reasoningEffort}` : options.model);
     }
     const runOptions = { ...options, env };
     const raw = runOptions.dockerExec
@@ -80,23 +87,22 @@ async function prepareOpenCodeConfig(mcpConfigPath, env) {
         mcp[name] = {
             type: "remote",
             url,
-            enabled: true,
+            disabled: false,
             oauth: false,
             ...(Object.keys(headers).length > 0 ? { headers } : {}),
         };
     }
     const config = {
         $schema: "https://opencode.ai/config.json",
-        autoupdate: false,
+        update: "disable",
         share: "disabled",
-        plugin: [],
-        mcp,
-        permission: {
-            "*": "allow",
-            external_directory: "deny",
-            question: "deny",
-            doom_loop: "deny",
-        },
+        plugins: [],
+        mcp: { servers: mcp },
+        permissions: [
+            { action: "*", resource: "*", effect: "allow" },
+            { action: "external_directory", resource: "*", effect: "deny" },
+            { action: "question", resource: "*", effect: "deny" },
+        ],
     };
     const configPath = `${mcpConfigPath}.opencode.json`;
     const configDir = `${mcpConfigPath}.opencode-config`;
@@ -186,6 +192,42 @@ function parseOpenCodeEvents(stdout) {
 function nonNegativeMetric(value) {
     return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
 }
+/** Inspect only provider error envelopes/logs, never tool output or assistant text. */
+function capacityMonitor(onLimit) {
+    const pending = { stdout: "", stderr: "" };
+    const inspect = (line, stream) => {
+        let detail = "";
+        try {
+            const event = JSON.parse(line);
+            if (event.type === "error" || event.type === "session.error") {
+                const error = event.error ?? event.properties?.error;
+                detail = typeof error === "string" ? error : error?.data?.message ?? error?.message ?? "";
+            }
+        }
+        catch {
+            // OpenCode's log format varies by version. Require a stream-error log
+            // to avoid confusing a tool's own HTTP 429 with provider exhaustion.
+            if (stream === "stderr" && /\bERROR\b/.test(line) && /stream error/i.test(line)) {
+                detail = line;
+            }
+        }
+        if (typeof detail === "string" && /\b(?:rate|usage|session)\s+limit\b|\btoo many requests\b/i.test(detail)) {
+            onLimit(detail);
+        }
+    };
+    return {
+        push(stream, chunk) {
+            const lines = (pending[stream] + chunk).split(/\r?\n/);
+            pending[stream] = lines.pop() ?? "";
+            for (const line of lines)
+                inspect(line, stream);
+        },
+        flush() {
+            inspect(pending.stdout, "stdout");
+            inspect(pending.stderr, "stderr");
+        },
+    };
+}
 async function runOnHost(options, args) {
     return new Promise((resolve) => {
         let stdout = "";
@@ -197,6 +239,11 @@ async function runOnHost(options, args) {
             cwd: options.cwd,
             env: { ...process.env, ...options.env },
         });
+        let capacityError;
+        const monitor = capacityMonitor((detail) => {
+            capacityError ??= detail;
+            (0, kill_agent_cjs_1.killAgent)(child);
+        });
         child.stdin?.end();
         options.onProcessStarted?.(child.pid);
         const timer = options.timeoutMs > 0 ? setTimeout(() => {
@@ -213,21 +260,25 @@ async function runOnHost(options, args) {
         child.stdout.on("data", (data) => {
             options.onActivity?.();
             stdout += data.toString();
+            monitor.push("stdout", data.toString());
         });
         child.stderr.on("data", (data) => {
             options.onActivity?.();
             stderr += data.toString();
+            monitor.push("stderr", data.toString());
         });
         child.on("error", (error) => {
             clearTimeout(timer);
             options.signal?.removeEventListener("abort", onAbort);
             stderr += `\n${String(error)}`;
-            resolve({ exitCode: null, timedOut, killedByLeaseLoss, stdout, stderr });
+            monitor.flush();
+            resolve({ exitCode: null, timedOut, killedByLeaseLoss, stdout, stderr, capacityError });
         });
         child.on("close", (code) => {
             clearTimeout(timer);
             options.signal?.removeEventListener("abort", onAbort);
-            resolve({ exitCode: code, timedOut, killedByLeaseLoss, stdout, stderr });
+            monitor.flush();
+            resolve({ exitCode: code, timedOut, killedByLeaseLoss, stdout, stderr, capacityError });
         });
     });
 }
@@ -236,8 +287,19 @@ async function runViaDocker(options, args) {
     const quoted = [options.bin, ...args].map(shellQuote).join(" ");
     const command = `[ -f /tmp/session.env ] && . /tmp/session.env; cd repo 2>/dev/null; ${quoted}`;
     let killedByLeaseLoss = false;
+    let capacityError;
+    const controller = new AbortController();
+    const streamed = { stdout: false, stderr: false };
+    const monitor = capacityMonitor((detail) => {
+        if (capacityError)
+            return;
+        capacityError = detail;
+        controller.abort();
+        runner.run("docker", ["kill", containerName], { timeoutMs: 10_000 }).catch(() => undefined);
+    });
     const onAbort = () => {
         killedByLeaseLoss = true;
+        controller.abort();
         runner.run("docker", ["kill", containerName], { timeoutMs: 10_000 }).catch(() => undefined);
     };
     options.signal?.addEventListener("abort", onAbort, { once: true });
@@ -247,10 +309,19 @@ async function runViaDocker(options, args) {
         const forwardedEnv = Object.keys(options.env).flatMap((name) => ["--env", name]);
         const result = await runner.run("docker", ["exec", ...forwardedEnv, containerName, "sh", "-c", command], { timeoutMs: options.timeoutMs,
             onActivity: options.onActivity,
-            signal: options.signal,
+            signal: controller.signal,
+            onStdout: (chunk) => { streamed.stdout = true; monitor.push("stdout", chunk); },
+            onStderr: (chunk) => { streamed.stderr = true; monitor.push("stderr", chunk); },
             env: { ...process.env, ...options.env },
         });
+        // Also inspect runners that only return buffered output.
+        if (!streamed.stdout)
+            monitor.push("stdout", result.stdout);
+        if (!streamed.stderr)
+            monitor.push("stderr", result.stderr);
+        monitor.flush();
         return {
+            capacityError,
             exitCode: result.code,
             timedOut: false,
             killedByLeaseLoss,
@@ -260,6 +331,7 @@ async function runViaDocker(options, args) {
     }
     catch (error) {
         return {
+            capacityError,
             exitCode: null,
             timedOut: false,
             killedByLeaseLoss,

package/dist/adapters/qoder.cjs

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.qoderAdapter = void 0;
+exports.runQoderAdapter = runQoderAdapter;
+const node_child_process_1 = require("node:child_process");
+const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
+const kill_agent_cjs_1 = require("../kill-agent.cjs");
+function hasFlag(args, flag) {
+    return args.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
+}
+/**
+ * Headless Qoder CLI adapter: `qoder -p "<prompt>" --output-format json`.
+ * Qoder's print mode emits the same single-JSON result shape as Claude Code
+ * (verified against qodercli 1.1.56), so usage/cost parsing reuses
+ * parseClaudeJsonResult and its result text lands in the ordinary
+ * exit-conditions path.
+ *
+ * Model selection is account-owned (`qoder --list-models`), so the claim-time
+ * `"default"` sentinel (execution-policy.ts / session.cts) is passed through
+ * as no `--model` flag; an explicit pin from `--model` at enroll or
+ * NAVARCH_QODER_EXTRA_ARGS still reaches the CLI.
+ */
+async function runQoderAdapter(options) {
+    if (options.signal?.aborted) {
+        return { exitCode: null, timedOut: false, killedByLeaseLoss: true, stdout: "", stderr: "" };
+    }
+    const args = ["-p", options.prompt];
+    // Runtime sessions must not inherit an operator's personal or project-local
+    // Qoder hooks, for the same reason as the Claude adapter: they make
+    // execution machine-dependent and can fail otherwise-good sessions. The
+    // empty source list still permits an explicit --settings file below.
+    if (!hasFlag(options.extraArgs, "--setting-sources")) {
+        args.push("--setting-sources", "");
+    }
+    // Unattended sessions route permission decisions through Qoder's native
+    // auto classifier rather than prompting or bypassing checks.
+    if (!["--permission-mode", "--permission-prompt-tool", "--dangerously-skip-permissions"].some((flag) => hasFlag(options.extraArgs, flag))) {
+        args.push("--permission-mode", "auto");
+    }
+    if (options.settingsPath && !hasFlag(options.extraArgs, "--settings")) {
+        args.push("--settings", options.settingsPath);
+    }
+    if (options.mcpConfigPath) {
+        args.push("--mcp-config", options.mcpConfigPath);
+    }
+    if (!hasFlag(options.extraArgs, "--output-format")) {
+        args.push("--output-format", "json");
+    }
+    args.push(...options.extraArgs);
+    if (options.model && options.model !== "default" && !hasFlag(options.extraArgs, "--model")) {
+        args.push("--model", options.model);
+    }
+    if (options.reasoningEffort && !hasFlag(options.extraArgs, "--reasoning-effort")) {
+        args.push("--reasoning-effort", options.reasoningEffort);
+    }
+    const raw = options.dockerExec ? await runViaDocker(options, args) : await runOnHost(options, args);
+    return attachUsage(raw);
+}
+/** Parses stdout for `qoder -p --output-format json` usage and folds it onto the raw result (best-effort). */
+function attachUsage(result) {
+    const parsed = (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stdout);
+    if (!parsed)
+        return result;
+    const usage = (0, exit_conditions_cjs_1.extractUsageFromClaudeJson)(parsed);
+    return {
+        ...result,
+        tokensIn: usage.tokensIn,
+        tokensOut: usage.tokensOut,
+        cacheHitTokensIn: usage.cacheHitTokensIn,
+        costUsd: usage.costUsd,
+    };
+}
+async function runOnHost(options, args) {
+    return new Promise((resolve) => {
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        let killedByLeaseLoss = false;
+        const child = (0, node_child_process_1.spawn)(options.bin, args, {
+            detached: process.platform !== "win32",
+            cwd: options.cwd,
+            env: { ...process.env, ...options.env },
+        });
+        // `qoder -p` checks stdin for a piped prompt; close it so the child does
+        // not wait when the complete prompt was supplied as an argument.
+        child.stdin?.end();
+        options.onProcessStarted?.(child.pid);
+        const timer = options.timeoutMs > 0 ? setTimeout(() => {
+            timedOut = true;
+            (0, kill_agent_cjs_1.killAgent)(child);
+        }, options.timeoutMs) : undefined;
+        const onAbort = () => {
+            killedByLeaseLoss = true;
+            (0, kill_agent_cjs_1.killAgent)(child);
+        };
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        if (options.signal?.aborted)
+            onAbort();
+        child.stdout.on("data", (d) => {
+            options.onActivity?.();
+            stdout += d.toString();
+        });
+        child.stderr.on("data", (d) => {
+            options.onActivity?.();
+            stderr += d.toString();
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", onAbort);
+            stderr += `\n${String(err)}`;
+            resolve({ exitCode: null, timedOut, killedByLeaseLoss, stdout, stderr });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", onAbort);
+            resolve({ exitCode: code, timedOut, killedByLeaseLoss, stdout, stderr });
+        });
+    });
+}
+async function runViaDocker(options, args) {
+    const { containerName, runner } = options.dockerExec;
+    const quoted = [options.bin, ...args].map(shellQuote).join(" ");
+    const command = `[ -f /tmp/session.env ] && . /tmp/session.env; cd repo 2>/dev/null; ${quoted}`;
+    let killedByLeaseLoss = false;
+    const onAbort = () => {
+        killedByLeaseLoss = true;
+        runner.run("docker", ["kill", containerName], { timeoutMs: 10_000 }).catch(() => undefined);
+    };
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    if (options.signal?.aborted)
+        onAbort();
+    try {
+        const result = await runner.run("docker", ["exec", containerName, "sh", "-c", command], {
+            timeoutMs: options.timeoutMs,
+            onActivity: options.onActivity,
+            signal: options.signal,
+        });
+        return {
+            exitCode: result.code,
+            timedOut: false,
+            killedByLeaseLoss,
+            stdout: result.stdout,
+            stderr: result.stderr,
+        };
+    }
+    catch (err) {
+        return {
+            exitCode: null,
+            timedOut: false,
+            killedByLeaseLoss,
+            stdout: "",
+            stderr: String(err),
+        };
+    }
+    finally {
+        options.signal?.removeEventListener("abort", onAbort);
+    }
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** The AgentAdapter (adapters/types.cts) wrapper session.cts selects via NAVARCH_AGENT=qoder. */
+exports.qoderAdapter = {
+    agentType: "qoder",
+    run: runQoderAdapter,
+};

package/dist/cli.cjs

@@ -61,18 +61,24 @@ function superviseInvocation(configDir) {
     return `${invocation("supervise")} --config-dir ${configDir}`;
 }
 /** Resolve CLI-local configuration without mutating the parent shell environment. */
-function configFromFlags(flags) {
-    const configDir = flags["config-dir"];
-    return (0, config_cjs_1.loadRuntimeConfig)(configDir
-        ? { ...process.env, NAVARCH_CONFIG_DIR: node_path_1.default.resolve(configDir) }
-        : process.env);
+function configFromFlags(flags, identity) {
+    const env = { ...process.env };
+    if (flags["config-dir"])
+        env.NAVARCH_CONFIG_DIR = node_path_1.default.resolve(flags["config-dir"]);
+    // Resolve the preferred adapter before deriving the advertised runtimes and
+    // applying host guards. Keep an explicit NAVARCH_RUNTIMES list intact.
+    const agentType = agentFromFlag(flags) ?? (env.NAVARCH_AGENT || identity?.agent_type);
+    if (agentType)
+        env.NAVARCH_AGENT = agentType;
+    const config = (0, config_cjs_1.loadRuntimeConfig)(env);
+    return { ...config, model: modelFromFlags(flags, config.agentType, identity) };
 }
 function agentFromFlag(flags) {
     const value = flags.agent;
     if (value === undefined)
         return undefined;
     if (!(0, config_cjs_1.isRuntimeAgentType)(value)) {
-        throw new Error("--agent must be one of 'claude-code', 'codex', 'gemini', 'opencode', or 'acp'.");
+        throw new Error("--agent must be one of 'claude-code', 'codex', 'gemini', 'opencode', 'acp', or 'qoder'.");
     }
     return value;
 }
@@ -202,12 +208,7 @@ async function connectCommand(flags) {
 async function startCommand(flags) {
     const baseConfig = configFromFlags(flags);
     const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(baseConfig.configDir, baseConfig.apiBase);
-    // Adapter selection belongs to the local machine: an explicit start flag
-    // wins, followed by NAVARCH_AGENT, the choice saved at connect/register
-    // time, and finally the backwards-compatible Claude Code default.
-    const agentType = agentFromFlag(flags) ??
-        (process.env.NAVARCH_AGENT ? baseConfig.agentType : identity.agent_type ?? baseConfig.agentType);
-    const config = { ...baseConfig, agentType, model: modelFromFlags(flags, agentType, identity) };
+    const config = configFromFlags(flags, identity);
     const api = new api_cjs_1.NavarchApiClient({ baseUrl: identity.api_base, token: identity.token });
     const capacity = new capacity_cjs_1.CapacityTracker(config.maxSessions);
     const runtimeShutdown = new AbortController();
@@ -283,19 +284,17 @@ async function startCommand(flags) {
     process.on("SIGTERM", shutdown);
 }
 async function superviseCommand(flags) {
-    const config = configFromFlags(flags);
-    const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(config.configDir, config.apiBase);
+    const baseConfig = configFromFlags(flags);
+    const identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(baseConfig.configDir, baseConfig.apiBase);
+    const config = configFromFlags(flags, identity);
     // Resolve and pin the adapter before spawning the worker. The supervisor
     // passes machine credentials through the environment, so the child no
     // longer reads machine.json for identity fields (including agent_type).
     // Without an explicit worker argument, any saved non-Claude selection
     // would therefore fall back to Claude Code.
-    const agentType = agentFromFlag(flags) ??
-        (process.env.NAVARCH_AGENT ? config.agentType : identity.agent_type ?? config.agentType);
-    const workerArgs = ["--agent", agentType];
-    const model = modelFromFlags(flags, agentType, identity);
-    if (model)
-        workerArgs.push("--model", model);
+    const workerArgs = ["--agent", config.agentType];
+    if (config.model)
+        workerArgs.push("--model", config.model);
     // Pin the identity for this supervisor's lifetime. Without this snapshot, a
     // replacement worker rereads machine.json after an automatic update and can
     // silently become a different machine if another terminal reused the same
@@ -315,8 +314,17 @@ async function doctorCommand(flags) {
     // start (config.cts). Report that as the diagnosis instead of rethrowing it
     // as a bare CLI error.
     let config;
+    let identity;
     try {
         config = configFromFlags(flags);
+        try {
+            identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(config.configDir, config.apiBase);
+        }
+        catch {
+            // Unregistered machines can still inspect their environment configuration.
+        }
+        if (identity)
+            config = configFromFlags(flags, identity);
     }
     catch (err) {
         console.log(`config:          UNUSABLE — ${err instanceof Error ? err.message : String(err)}`);
@@ -333,18 +341,12 @@ async function doctorCommand(flags) {
     console.log(`worktree_guard:  ${config.worktreeGuard ? "on" : "off"}`);
     console.log(`runtimes:        ${config.runtimes?.join(", ") ?? config.agentType}`);
     console.log(`docker:          ${dockerOk ? "available" : "NOT AVAILABLE (docker-backed sessions will fail)"}`);
-    let identity;
-    try {
-        identity = await (0, machine_store_cjs_1.resolveMachineIdentity)(config.configDir, config.apiBase);
-    }
-    catch {
+    if (!identity) {
         console.log(`machine:         not registered — run \`${invocation("register")}\``);
         return;
     }
-    const agentType = agentFromFlag(flags) ??
-        (process.env.NAVARCH_AGENT ? config.agentType : identity.agent_type ?? config.agentType);
     console.log(`machine:         ${identity.name} (${identity.machine_id})`);
-    console.log(`agent:           ${agentType}`);
+    console.log(`agent:           ${config.agentType}`);
 }
 function helpText() {
     return `navarch-runtime — Navarch machine-side session manager

package/dist/config.cjs

@@ -17,7 +17,8 @@ function isRuntimeAgentType(value) {
         value === "codex" ||
         value === "gemini" ||
         value === "opencode" ||
-        value === "acp");
+        value === "acp" ||
+        value === "qoder");
 }
 function envInt(env, name, fallback) {
     const raw = env[name];
@@ -123,6 +124,8 @@ function loadRuntimeConfig(env = process.env) {
         opencodeExtraArgs: envList(env, "NAVARCH_OPENCODE_EXTRA_ARGS", []),
         acpBin: env.NAVARCH_ACP_BIN ?? "dsh",
         acpExtraArgs: envList(env, "NAVARCH_ACP_EXTRA_ARGS", ["--profile", "acp"]),
+        qoderBin: env.NAVARCH_QODER_BIN ?? "qoder",
+        qoderExtraArgs: envList(env, "NAVARCH_QODER_EXTRA_ARGS", []),
         gitAuthorName: env.NAVARCH_GIT_AUTHOR_NAME ?? "sagentlab",
         gitAuthorEmail: env.NAVARCH_GIT_AUTHOR_EMAIL ?? "z@sagentlab.com",
         mcpConfigPath: env.NAVARCH_MCP_CONFIG_PATH ?? null,

package/dist/exit-conditions.cjs

@@ -229,6 +229,16 @@ function mapExitCondition(result) {
             evidenceUrls,
         };
     }
+    if (result.capacityError) {
+        return {
+            leaseOutcome: "failed",
+            exitStatus: "failed",
+            reportSummary: summarize(`Session stopped: provider capacity exhausted. ${result.capacityError}`) +
+                (result.checkpointPath ? ` Local recovery checkpoint: ${result.checkpointPath}` : "") +
+                (result.retainedWorktreePath ? ` Recovery worktree retained: ${result.retainedWorktreePath}` : ""),
+            evidenceUrls,
+        };
+    }
     if (result.timedOut) {
         return {
             leaseOutcome: "failed",

package/dist/machine-store.cjs

@@ -52,7 +52,8 @@ async function resolveMachineIdentity(configDir, apiBaseFallback) {
                 process.env.NAVARCH_AGENT === "claude-code" ||
                 process.env.NAVARCH_AGENT === "gemini" ||
                 process.env.NAVARCH_AGENT === "opencode" ||
-                process.env.NAVARCH_AGENT === "acp"
+                process.env.NAVARCH_AGENT === "acp" ||
+                process.env.NAVARCH_AGENT === "qoder"
                 ? process.env.NAVARCH_AGENT
                 : undefined,
         };

package/dist/sandbox.cjs

@@ -40,10 +40,12 @@ exports.nodeCommandRunner = {
             child.stdout?.on("data", (d) => {
                 opts.onActivity?.();
                 stdout += d.toString();
+                opts.onStdout?.(d.toString());
             });
             child.stderr?.on("data", (d) => {
                 opts.onActivity?.();
                 stderr += d.toString();
+                opts.onStderr?.(d.toString());
             });
             child.on("error", (err) => {
                 if (settled)

package/dist/session.cjs

@@ -44,7 +44,7 @@ function resolveSessionExecution(config, claimed) {
         profile: claimed.task.execution_profile ?? "standard",
         model: runtime === "codex" ? "gpt-6-astra"
             : runtime === "gemini" ? "auto"
-                : runtime === "opencode" || runtime === "acp" ? "default"
+                : runtime === "opencode" || runtime === "acp" || runtime === "qoder" ? "default"
                     : "claude-opus-5",
         reasoning_effort: "medium",
     };
@@ -229,7 +229,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             return;
         try {
             result.checkpointPath = await gitWorktree.saveCheckpoint();
-            log.warn(`session ${leaseId} stopped for ${leaseLost ? "lease loss" : result.timeoutReason ?? "duration"}; recovery checkpoint: ${result.checkpointPath}`);
+            log.warn(`session ${leaseId} stopped for ${leaseLost ? "lease loss" : result.capacityError ? "provider capacity" : result.timeoutReason ?? "duration"}; recovery checkpoint: ${result.checkpointPath}`);
         }
         catch (error) {
             retainWorktree = true;
@@ -481,6 +481,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             attempts.push(turnResult);
             const capacityLimit = (0, adapter_capacity_cjs_1.detectAdapterCapacityLimit)(turnResult);
             if (capacityLimit) {
+                await checkpointForRecovery(turnResult);
                 sessionOutcome.claimCooldownUntil = Math.max(sessionOutcome.claimCooldownUntil ?? 0, capacityLimit.retryAtMs);
             }
             // Close the small race between a naturally completed turn and the next
@@ -495,7 +496,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 log.warn(`session ${leaseId} stopped without completion because its lease is no longer active.`);
                 return sessionOutcome;
             }
-            if (!leaseLost && !turnResult.timedOut && pendingGuidance.length > 0)
+            if (!capacityLimit && !leaseLost && !turnResult.timedOut && pendingGuidance.length > 0)
                 continue;
             const result = {
                 ...turnResult,
@@ -762,6 +763,8 @@ function adapterCommand(config, runtime) {
             return { bin: config.opencodeBin, extraArgs: config.opencodeExtraArgs };
         case "acp":
             return { bin: config.acpBin, extraArgs: config.acpExtraArgs };
+        case "qoder":
+            return { bin: config.qoderBin, extraArgs: config.qoderExtraArgs };
     }
 }
 /**
@@ -806,6 +809,8 @@ function verificationFailureReport(taskType, report) {
 }
 /** Rejection codes another agent turn in the same worktree can plausibly fix. */
 const REMEDIABLE_REJECTION_CODES = new Set([
+    "review_fix_required",
+    "review_fix_unavailable",
     "pr_required",
     // A video-deliverable build that completed without registering its render:
     // the file usually already exists in the worktree, so the remediation turn

package/dist/upload.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.uploadTranscript = uploadTranscript;
 /**
- * PUTs an already-redacted transcript to the signed Supabase Storage URL the
+ * PUTs an already-redacted transcript to the presigned R2 URL the
  * control plane hands back (schema-design.md §4 sessions.transcript_url;
  * implementation-plan.md WP-07). Kept as its own module so the storage
  * mechanism is a one-function swap if it ever changes.
@@ -16,9 +16,8 @@ async function uploadTranscript(uploadUrl, content, fetchImpl = fetch) {
         body: content,
     });
     if (!response.ok) {
-        // Supabase Storage answers with {statusCode, error, message} here, which is
-        // the only thing distinguishing an RLS rejection from a bad/expired token
-        // from a bucket misconfiguration. Without it a 403 is unattributable.
+        // Include the bounded storage response to distinguish expired signatures
+        // from bucket misconfiguration.
         throw new Error(`Transcript upload failed with ${response.status}: ${await readErrorBody(response)}`);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",