@sagentlab/navarch-runtime 0.1.53 → 0.1.55

package/dist/adapters/opencode.cjs

@@ -1,9 +1,14 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.openCodeAdapter = void 0;
 exports.runOpenCodeAdapter = runOpenCodeAdapter;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
 const config_cjs_1 = require("../config.cjs");
 const kill_agent_cjs_1 = require("../kill-agent.cjs");
 /**
@@ -30,7 +35,7 @@ async function runOpenCodeAdapter(options) {
         };
     }
     const env = { ...options.env };
-    await prepareOpenCodeConfig(options.mcpConfigPath, env);
+    await prepareOpenCodeConfig(options.mcpConfigPath, env, Boolean(options.dockerExec));
     const args = ["run", options.prompt];
     // Provider failures may only appear in logs, absent from assistant events.
     if (!hasArg(options.extraArgs, "--print-logs"))
@@ -57,7 +62,7 @@ async function runOpenCodeAdapter(options) {
 function hasArg(args, ...flags) {
     return args.some((arg) => flags.some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
 }
-async function prepareOpenCodeConfig(mcpConfigPath, env) {
+async function prepareOpenCodeConfig(mcpConfigPath, env, inDocker) {
     if (!mcpConfigPath) {
         throw new Error("OpenCode requires a per-session MCP config path for isolated execution.");
     }
@@ -101,6 +106,11 @@ async function prepareOpenCodeConfig(mcpConfigPath, env) {
         permissions: [
             { action: "*", resource: "*", effect: "allow" },
             { action: "external_directory", resource: "*", effect: "deny" },
+            ...(await openCodeManagedDirectories(env, inDocker)).map((resource) => ({
+                action: "external_directory",
+                resource,
+                effect: "allow",
+            })),
             { action: "question", resource: "*", effect: "deny" },
         ],
     };
@@ -117,6 +127,39 @@ async function prepareOpenCodeConfig(mcpConfigPath, env) {
     env.OPENCODE_DISABLE_PROJECT_CONFIG = "true";
     env.XDG_CONFIG_HOME = xdgConfigHome;
 }
+/**
+ * OpenCode's own scratch locations: `os.tmpdir()/opencode` and the data dir's
+ * truncated tool-output and background-shell output files. OpenCode grants
+ * itself `external_directory` access to these, but config rules are appended
+ * after its grants and the last matching rule wins, so the blanket deny above
+ * would otherwise hide a background command's log from the agent. Inside the
+ * sandbox container the Linux defaults apply (`~` expands to the OpenCode
+ * process's home); on the host they follow the child environment, plus the
+ * canonical temp path since OpenCode canonicalizes before matching (macOS
+ * `/var` -> `/private/var`).
+ */
+async function openCodeManagedDirectories(env, inDocker) {
+    if (inDocker) {
+        return [
+            "/tmp/opencode/*",
+            "~/.local/share/opencode/tool-output/*",
+            "~/.local/share/opencode/shell/*/*",
+        ];
+    }
+    const tmpRoot = env.TMPDIR || process.env.TMPDIR || node_os_1.default.tmpdir();
+    const tmpRoots = [tmpRoot, await node_fs_1.promises.realpath(tmpRoot).catch(() => tmpRoot)];
+    const dataHome = env.XDG_DATA_HOME ||
+        process.env.XDG_DATA_HOME ||
+        node_path_1.default.join(env.HOME || node_os_1.default.homedir(), ".local", "share");
+    const data = node_path_1.default.join(dataHome, "opencode");
+    return [
+        ...new Set([
+            ...tmpRoots.map((root) => node_path_1.default.join(root, "opencode", "*")),
+            node_path_1.default.join(data, "tool-output", "*"),
+            node_path_1.default.join(data, "shell", "*", "*"),
+        ]),
+    ];
+}
 function safeEnvSegment(value) {
     return value.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
 }

package/dist/session.cjs

@@ -94,7 +94,7 @@ async function runSession(deps, claimed, sessionId) {
         await api
             .completeLease(leaseId, {
             status: "failed",
-            report: verificationFailureReport(task.task_type, failureSummary),
+            report: verificationFailureReport(task.task_type, failureSummary, "crashed"),
             failure_summary: failureSummary,
             failed_before_start: true,
             evidence_urls: [],
@@ -174,7 +174,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         const failureSummary = `Project ${task.project_id} has no GitHub repository URL. Set it in Project settings before dispatching work.`;
         await api.completeLease(leaseId, {
             status: "failed",
-            report: verificationFailureReport(task.task_type, failureSummary),
+            report: verificationFailureReport(task.task_type, failureSummary, "crashed"),
             failure_summary: failureSummary,
             failed_before_start: true,
             evidence_urls: [],
@@ -294,7 +294,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
         await api
             .completeLease(leaseId, {
             status: "failed",
-            report: verificationFailureReport(task.task_type, "Docker sandbox unavailable on this machine."),
+            report: verificationFailureReport(task.task_type, "Docker sandbox unavailable on this machine.", "crashed"),
             failure_summary: "Docker sandbox unavailable on this machine.",
             failed_before_start: true,
             evidence_urls: [],
@@ -616,7 +616,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             const completion = {
                 status: mapping.leaseOutcome,
                 report: mapping.leaseOutcome === "failed"
-                    ? verificationFailureReport(task.task_type, redactedReport)
+                    ? verificationFailureReport(task.task_type, redactedReport, mapping.exitStatus)
                     : redactedReport,
                 evidence_urls: mapping.evidenceUrls,
                 ...(deliveryFailureSummary
@@ -674,7 +674,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                         status: "failed",
                         report: verificationFailureReport(task.task_type, remediable
                             ? redactedRejection
-                            : `${redactedRejection}\n\n---\n\n${completion.report}`),
+                            : `${redactedRejection}\n\n---\n\n${completion.report}`, "failed"),
                         failure_summary: redactedRejection,
                         exit_status: "failed",
                     });
@@ -708,7 +708,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             status: "failed",
             report: verificationFailureReport(task.task_type, lastCompletion
                 ? `${lastCompletion.report}\n\n---\n\n${failureSummary}`
-                : failureSummary),
+                : failureSummary, "crashed"),
             failure_summary: failureSummary,
             failed_before_start: !adapterStarted,
             evidence_urls: lastCompletion?.evidence_urls ?? [],
@@ -794,14 +794,23 @@ function sumReportedUsage(attempts, key) {
  * does not open with `Verification verdict: FAIL` or `BLOCKED`
  * (verification_verdict_invalid), and that gate applies to runtime-authored
  * failure reports too. When the report carries no usable verdict — the agent
- * crashed, timed out, exited non-zero, or opened with PASS despite the failed
- * outcome — label it BLOCKED: the failure prevented an acceptance decision.
- * Without this, the failure completion is itself rejected, the session
- * crashes, and the lease dangles until expiry.
+ * exited non-zero, or opened with PASS despite the failed outcome — label it
+ * BLOCKED: the failure prevented an acceptance decision. Without this, the
+ * failure completion is itself rejected, the session crashes, and the lease
+ * dangles until expiry.
+ *
+ * A `killed` or `crashed` exit is left unlabelled: the control plane accepts
+ * those verdict-less as the runtime's own failure and routes them through
+ * failure attribution (an infrastructure retry). A BLOCKED label there would
+ * misreport a transient timeout as a verifier verdict and escalate it to a
+ * human; the control plane discards such a label, so posting it only muddies
+ * the session report.
  */
-function verificationFailureReport(taskType, report) {
+function verificationFailureReport(taskType, report, exitStatus) {
     if (taskType !== "verify")
         return report;
+    if (exitStatus === "killed" || exitStatus === "crashed")
+        return report;
     const verdict = (0, exit_conditions_cjs_1.leadingVerificationVerdict)(report);
     if (verdict === "fail" || verdict === "blocked")
         return report;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",