@sagentlab/navarch-runtime 0.1.71 → 0.1.73

package/dist/browser-evidence.cjs

@@ -96,40 +96,55 @@ async function startBrowserEvidence(options) {
                         throw new Error("Screenshot exceeds 25 MiB.");
                     assertActive();
                     const fileName = `${args.evidence_role}-${viewport}-${(0, node_crypto_1.randomUUID)()}.png`;
-                    const registration = await fetchImpl(`${options.apiBase.replace(/\/+$/, "")}/api/mcp`, {
-                        method: "POST",
-                        signal: AbortSignal.timeout(30_000),
-                        headers: {
-                            authorization: `Bearer ${options.machineToken}`,
-                            "x-navarch-lease-id": options.leaseId,
-                            "content-type": "application/json",
-                            accept: "application/json, text/event-stream",
-                            "mcp-protocol-version": "2025-06-18",
-                        },
-                        body: JSON.stringify({ jsonrpc: "2.0", id: (0, node_crypto_1.randomUUID)(), method: "tools/call", params: {
-                                name: "register_artifact", arguments: {
-                                    file_name: fileName, mime_type: "image/png", size_bytes: bytes.length,
-                                    checksum_sha256: (0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex"),
-                                    source_commit_sha: args.source_commit_sha, evidence_role: args.evidence_role,
-                                },
-                            } }),
+                    const callTool = async (name, toolArgs) => {
+                        const response = await fetchImpl(`${options.apiBase.replace(/\/+$/, "")}/api/mcp`, {
+                            method: "POST",
+                            signal: AbortSignal.timeout(30_000),
+                            headers: {
+                                authorization: `Bearer ${options.machineToken}`,
+                                "x-navarch-lease-id": options.leaseId,
+                                "content-type": "application/json",
+                                accept: "application/json, text/event-stream",
+                                "mcp-protocol-version": "2025-06-18",
+                            },
+                            body: JSON.stringify({ jsonrpc: "2.0", id: (0, node_crypto_1.randomUUID)(), method: "tools/call", params: {
+                                    name, arguments: toolArgs,
+                                } }),
+                        });
+                        if (!response.ok)
+                            throw new Error(`Artifact ${name} returned HTTP ${response.status}.`);
+                        const result = await response.json();
+                        if (result.error || result.result?.isError || !result.result?.structuredContent) {
+                            throw new Error(`Artifact ${name} was rejected.`);
+                        }
+                        return result.result.structuredContent;
+                    };
+                    const registered = await callTool("register_artifact", {
+                        file_name: fileName, mime_type: "image/png", size_bytes: bytes.length,
+                        checksum_sha256: (0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex"),
+                        source_commit_sha: args.source_commit_sha, evidence_role: args.evidence_role,
                     });
-                    if (!registration.ok)
-                        throw new Error(`Artifact registration returned HTTP ${registration.status}.`);
-                    const result = await registration.json();
-                    const destination = result.result?.structuredContent;
-                    if (result.error || result.result?.isError || !destination?.upload_url || !destination.public_url
-                        || new URL(destination.upload_url).protocol !== "https:" || new URL(destination.public_url).protocol !== "https:") {
-                        throw new Error("Artifact registration did not provide secure upload and public URLs.");
+                    const { upload_url: uploadUrl, artifact_version_id: versionId } = registered;
+                    if (typeof uploadUrl !== "string" || typeof versionId !== "string" || new URL(uploadUrl).protocol !== "https:") {
+                        throw new Error("Artifact registration did not provide a secure upload URL.");
                     }
                     assertActive();
-                    const upload = await fetchImpl(destination.upload_url, {
-                        method: "PUT", headers: { "content-type": "image/png" },
+                    // The signed URL is creation-only: Content-Type and If-None-Match are
+                    // signed headers, so the PUT must send both or storage returns 403.
+                    const upload = await fetchImpl(uploadUrl, {
+                        method: "PUT", headers: { "content-type": "image/png", "if-none-match": "*" },
                         body: new Uint8Array(bytes), signal: AbortSignal.timeout(30_000),
                     });
                     if (!upload.ok)
                         throw new Error(`Screenshot upload returned HTTP ${upload.status}.`);
-                    const item = { fileName, publicUrl: destination.public_url,
+                    assertActive();
+                    // The artifact is not published (or completion-eligible) until finalized.
+                    const finalized = await callTool("finalize_artifact", { artifact_version_id: versionId });
+                    const publicUrl = finalized.public_url;
+                    if (finalized.artifact_version_id !== versionId || typeof publicUrl !== "string" || new URL(publicUrl).protocol !== "https:") {
+                        throw new Error("Artifact finalization did not provide a secure public URL.");
+                    }
+                    const item = { fileName, publicUrl,
                         sourceCommitSha: args.source_commit_sha, role: args.evidence_role, viewport };
                     evidence.push(item);
                     captured.push(item);

package/dist/git-worktree.cjs

@@ -11,6 +11,14 @@ const worktree_janitor_cjs_1 = require("./worktree-janitor.cjs");
 const node_fs_1 = require("node:fs");
 const sandbox_cjs_1 = require("./sandbox.cjs");
 const repositoryLocks = new Map();
+/**
+ * A freshly minted installation token can be rejected for a second or two
+ * before GitHub propagates it, and git reports that 404 on a private repo as
+ * "Repository not found". Every lease gets a new token, so the first clone
+ * right after a claim can land in that window.
+ */
+const DEFAULT_AUTH_RETRY_DELAYS_MS = [1_000, 2_000, 4_000];
+const TRANSIENT_GIT_AUTH_FAILURE = /Repository not found|Authentication failed|could not read Username|The requested URL returned error: (?:401|403|404)|\bHTTP (?:401|403|404)\b/i;
 /**
  * Maintains one bare repository cache per project and checks out each session
  * into its own uniquely named worktree. Sessions that need a repo-local secret
@@ -27,6 +35,8 @@ class GitWorktree {
     /** Why an existing hosted checkpoint could not be restored, for the session log. */
     hostedCheckpointRestoreFailure = null;
     runner;
+    authRetryDelaysMs;
+    sleep;
     checkpointRoot;
     cloneUrl;
     githubToken;
@@ -64,6 +74,8 @@ class GitWorktree {
         this.branch = `navarch/${branchSlug(options)}${this.taskBranchSuffix}` +
             (options.prContinuation ? `-${sessionKey}` : "");
         this.runner = options.runner ?? sandbox_cjs_1.nodeCommandRunner;
+        this.authRetryDelaysMs = options.authRetryDelaysMs ?? DEFAULT_AUTH_RETRY_DELAYS_MS;
+        this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
         this.cloneUrl = options.cloneUrl;
         this.githubToken = options.githubToken;
         this.repoLocalGithubToken = options.repoLocalGithubToken;
@@ -134,7 +146,11 @@ class GitWorktree {
     /** Clones the bare cache if missing, repoints origin if needed, and fetches all branches. */
     async ensureRepositoryCache() {
         if (!(await pathExists(node_path_1.default.join(this.repositoryPath, "HEAD")))) {
-            await this.runGit(["clone", "--bare", this.cloneUrl, this.repositoryPath], true);
+            await this.runAuthenticatedGitWithRetry(["clone", "--bare", this.cloneUrl, this.repositoryPath], 
+            // A failed clone can leave a partial bare repository behind, and git
+            // refuses to clone into a non-empty directory. No HEAD means nothing
+            // usable (or shared) lives there yet.
+            () => node_fs_1.promises.rm(this.repositoryPath, { recursive: true, force: true }));
         }
         else {
             const origin = await this.runGit(["--git-dir", this.repositoryPath, "remote", "get-url", "origin"], false);
@@ -142,14 +158,34 @@ class GitWorktree {
                 await this.runGit(["--git-dir", this.repositoryPath, "remote", "set-url", "origin", this.cloneUrl], false);
             }
         }
-        await this.runGit([
+        await this.runAuthenticatedGitWithRetry([
             "--git-dir",
             this.repositoryPath,
             "fetch",
             "--prune",
             "origin",
             "+refs/heads/*:refs/remotes/origin/*",
-        ], true);
+        ]);
+    }
+    /**
+     * Runs a token-authenticated git command, retrying with backoff while GitHub
+     * rejects the credential in a way a not-yet-propagated token produces.
+     * Without a token such a failure is a real access problem and fails at once.
+     */
+    async runAuthenticatedGitWithRetry(args, beforeRetry) {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                return await this.runGit(args, true);
+            }
+            catch (error) {
+                const delay = this.authRetryDelaysMs[attempt];
+                if (!this.githubToken || delay === undefined || !TRANSIENT_GIT_AUTH_FAILURE.test(errorMessage(error))) {
+                    throw error;
+                }
+                await this.sleep(delay);
+                await beforeRetry?.();
+            }
+        }
     }
     async addSessionWorktree() {
         // A failed session may have pushed before it could report completion. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",