@sagentlab/navarch-runtime 0.1.75 → 0.1.77

package/dist/agent-auth.cjs

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAgentAuthFailure = detectAgentAuthFailure;
+const exit_conditions_cjs_1 = require("./exit-conditions.cjs");
+/**
+ * Errors the coding agent CLIs print when their stored login cannot be used.
+ * Matched only against CLI-authored error channels (a structured error result,
+ * Codex error events, stderr), never the agent's own prose, so a task about a
+ * login page cannot pause the machine.
+ *
+ * - Claude Code: "Failed to authenticate: OAuth session expired and could not
+ *   be refreshed", "OAuth token has expired", "Invalid API key · Please run
+ *   /login", "Not logged in · Please run /login", 401 authentication_error.
+ * - Codex: "Your access token could not be refreshed because your refresh
+ *   token has expired/was already used", "Not logged in", "Please run `codex
+ *   login`", token_expired / refresh_token_* error codes.
+ */
+const AGENT_AUTH_PATTERNS = [
+    /\bfailed to authenticate\b/i,
+    /\boauth (?:session|token) (?:has )?expired\b/i,
+    /\bplease run \/login\b/i,
+    /\bnot logged in\b/i,
+    /\bcodex login\b/i,
+    /\baccess token could not be refreshed\b/i,
+    /\brefresh token (?:has expired|was already used|is invalid|expired)\b/i,
+    /\b(?:refresh_token_(?:expired|reused|invalidated)|token_expired)\b/i,
+    /\bauthentication_error\b/i,
+];
+function matchingLine(text) {
+    for (const line of text.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed && AGENT_AUTH_PATTERNS.some((pattern) => pattern.test(trimmed))) {
+            return trimmed.length > 300 ? `${trimmed.slice(0, 299)}…` : trimmed;
+        }
+    }
+    return null;
+}
+/**
+ * Detects a turn that ended because the coding agent CLI could not
+ * authenticate. Only failed turns qualify: a clean exit whose structured result
+ * is not an error did real work, whatever its transcript mentions.
+ */
+function detectAgentAuthFailure(result) {
+    if (result.killedByLeaseLoss || result.timedOut || result.capacityError)
+        return null;
+    const claude = (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stdout) ?? (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stderr);
+    if (claude) {
+        if (!claude.is_error && result.exitCode === 0)
+            return null;
+        if (claude.is_error && typeof claude.result === "string") {
+            const detail = matchingLine(claude.result);
+            if (detail)
+                return { detail };
+        }
+    }
+    const codexErrors = (0, exit_conditions_cjs_1.parseCodexJsonEvents)(result.stdout).flatMap((event) => {
+        const raw = event;
+        if (raw.type === "error" && typeof raw.message === "string")
+            return [raw.message];
+        if (raw.type === "turn.failed") {
+            const error = raw.error;
+            if (typeof error?.message === "string")
+                return [error.message];
+        }
+        return [];
+    });
+    if (result.exitCode === 0 && codexErrors.length === 0 && !claude?.is_error)
+        return null;
+    for (const message of codexErrors) {
+        const detail = matchingLine(message);
+        if (detail)
+            return { detail };
+    }
+    const detail = matchingLine(result.stderr);
+    return detail ? { detail } : null;
+}

package/dist/exit-conditions.cjs

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_AUTH_FAILURE_PREFIX = void 0;
+exports.agentAuthFailureReport = agentAuthFailureReport;
 exports.parseClaudeJsonResult = parseClaudeJsonResult;
 exports.extractUsageFromClaudeJson = extractUsageFromClaudeJson;
 exports.parseCodexJsonEvents = parseCodexJsonEvents;
@@ -8,6 +10,19 @@ exports.extractFinalMessageFromCodexEvents = extractFinalMessageFromCodexEvents;
 exports.leadingVerificationVerdict = leadingVerificationVerdict;
 exports.leadWithReviewFixMarker = leadWithReviewFixMarker;
 exports.mapExitCondition = mapExitCondition;
+/**
+ * Leading text of every report for a turn the coding agent CLI refused because
+ * its own login on this machine is gone (agent-auth.cts). The control plane
+ * recognizes it -- and the raw CLI errors, for older runtimes -- and requeues
+ * the task without spending a retry while pausing this machine's claims until
+ * someone logs in again (lib/navarch/failure-attribution.ts
+ * `provider.agent_auth`).
+ */
+exports.AGENT_AUTH_FAILURE_PREFIX = "Coding agent authentication failed";
+function agentAuthFailureReport(detail) {
+    return `${exports.AGENT_AUTH_FAILURE_PREFIX}: ${detail} ` +
+        "Log the coding agent in again on this machine (`claude /login` or `codex login`), then resume the agent.";
+}
 /**
  * Best-effort parse of `claude -p --output-format json` stdout into the
  * assumed result shape above. Tries the whole trimmed stdout first (the
@@ -260,6 +275,14 @@ function mapExitCondition(result) {
             evidenceUrls,
         };
     }
+    if (result.authError) {
+        return {
+            leaseOutcome: "failed",
+            exitStatus: "failed",
+            reportSummary: summarize(agentAuthFailureReport(result.authError)),
+            evidenceUrls,
+        };
+    }
     if (result.timedOut) {
         return {
             leaseOutcome: "failed",

package/dist/session.cjs

@@ -26,6 +26,7 @@ const worktree_guard_cjs_1 = require("./worktree-guard.cjs");
 const adapter_watchdog_cjs_1 = require("./adapter-watchdog.cjs");
 const lease_heartbeat_cjs_1 = require("./lease-heartbeat.cjs");
 const adapter_capacity_cjs_1 = require("./adapter-capacity.cjs");
+const agent_auth_cjs_1 = require("./agent-auth.cjs");
 const browser_evidence_cjs_1 = require("./browser-evidence.cjs");
 /** Filename the generated platform MCP config is written under inside the session metadata directory. */
 const MCP_CONFIG_FILENAME = "mcp-config.json";
@@ -551,6 +552,15 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 await checkpointForRecovery(turnResult);
                 sessionOutcome.claimCooldownUntil = Math.max(sessionOutcome.claimCooldownUntil ?? 0, capacityLimit.retryAtMs);
             }
+            // A dead CLI login fails every task this machine claims in well under a
+            // second. Report it as such so the control plane requeues the task
+            // without spending a retry and pauses this machine until it is logged in
+            // again, instead of burning the task's budget into needs_human.
+            const authFailure = capacityLimit ? null : (0, agent_auth_cjs_1.detectAgentAuthFailure)(turnResult);
+            if (authFailure) {
+                turnResult.authError = authFailure.detail;
+                log.warn(`session ${leaseId}: coding agent authentication failed: ${authFailure.detail}`);
+            }
             // Close the small race between a naturally completed turn and the next
             // scheduled heartbeat. If guidance landed, run another turn before the
             // lease can be completed. A terminal heartbeat response means the
@@ -563,7 +573,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 log.warn(`session ${leaseId} stopped without completion because its lease is no longer active.`);
                 return sessionOutcome;
             }
-            if (!capacityLimit && !leaseLost && !turnResult.timedOut && pendingGuidance.length > 0)
+            if (!capacityLimit && !authFailure && !leaseLost && !turnResult.timedOut && pendingGuidance.length > 0)
                 continue;
             const result = {
                 ...turnResult,

package/dist/update-coordinator.cjs

@@ -1,16 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RuntimeUpdateCoordinator = void 0;
+exports.RuntimeUpdateCoordinator = exports.UPDATE_RETRY_MAX_MS = exports.UPDATE_RETRY_BASE_MS = void 0;
 const logger_cjs_1 = require("./logger.cjs");
 const update_installer_cjs_1 = require("./update-installer.cjs");
 const version_cjs_1 = require("./version.cjs");
 const supervisor_cjs_1 = require("./supervisor.cjs");
 const log = (0, logger_cjs_1.createLogger)("update");
+// A failed stage reports `failed`, which sends a heartbeat at once, whose
+// response repeats the same directive. Without a pause that loop re-runs
+// `npm pack` several times a second (seen while npm's CDN still served the
+// pre-publish packument for a freshly rolled-out version).
+exports.UPDATE_RETRY_BASE_MS = 30_000;
+exports.UPDATE_RETRY_MAX_MS = 10 * 60_000;
+function directiveKey(directive) {
+    return `${directive.target_version}\0${directive.integrity}`;
+}
 class RuntimeUpdateCoordinator {
     options;
     targetInProgress = null;
     restartInProgress = null;
     warnedUnsupervised = false;
+    lastFailure = null;
     constructor(options) {
         this.options = options;
     }
@@ -26,6 +36,9 @@ class RuntimeUpdateCoordinator {
         }
         if (this.targetInProgress)
             return;
+        const key = directiveKey(directive);
+        if (this.lastFailure?.key === key && this.now() < this.lastFailure.retryAt)
+            return;
         this.targetInProgress = directive.target_version;
         void this.apply(directive);
     }
@@ -57,6 +70,9 @@ class RuntimeUpdateCoordinator {
             this.restartInProgress = null;
         }
     }
+    now() {
+        return (this.options.now ?? Date.now)();
+    }
     async apply(directive) {
         const { config, heartbeat, claimLoop, capacity } = this.options;
         try {
@@ -73,7 +89,11 @@ class RuntimeUpdateCoordinator {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            log.error(`runtime update failed: ${message}`);
+            const key = directiveKey(directive);
+            const failures = this.lastFailure?.key === key ? this.lastFailure.failures + 1 : 1;
+            const delayMs = Math.min(exports.UPDATE_RETRY_BASE_MS * 2 ** (failures - 1), exports.UPDATE_RETRY_MAX_MS);
+            this.lastFailure = { key, failures, retryAt: this.now() + delayMs };
+            log.error(`runtime update failed: ${message} (retrying ${directive.target_version} in ${Math.round(delayMs / 1000)}s)`);
             heartbeat.setUpdateState("failed", message.slice(0, 500));
             claimLoop.start();
             this.targetInProgress = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.75",
+  "version": "0.1.77",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",