@sagentlab/navarch-runtime 0.1.80 → 0.1.82

package/README.md

@@ -543,6 +543,15 @@ The Claude hook is a strong guardrail rather than a hard security boundary
 because shell paths are screened lexically. Codex's permission profile is
 enforced by its OS sandbox. For container-grade whole-process isolation use
 `NAVARCH_SANDBOX_MODE=docker`; neither host guard is installed in Docker mode.
+On Linux, Codex uses an explicit allowlist without a denied workspace-parent
+mount, avoiding bubblewrap startup failures with linked Git worktrees. Its
+`TMPDIR`, `TMP`, and `TEMP` point to a private `tmp` directory inside the session;
+the profile does not grant all of `/tmp`. Extra/tool roots that contain the
+workspace are omitted on Linux so they cannot expose sibling sessions or
+session metadata. This also applies when the workspace itself lives under `/tmp`.
+To verify the linked-worktree boundary on a Linux host with Codex installed,
+run `NAVARCH_TEST_REAL_CODEX=1 npm test -- tests/codex-linux-sandbox.test.cts`
+from `runtime/`. The smoke test uses local shell commands and makes no model calls.
 An operator-supplied `--settings` in `NAVARCH_CLAUDE_EXTRA_ARGS`, or an
 explicit Codex permission/sandbox option in `NAVARCH_CODEX_EXTRA_ARGS`, takes
 precedence over the generated policy.
@@ -959,7 +968,10 @@ different endpoint (for example, Ollama's `http://127.0.0.1:11434/v1`).
 `NAVARCH_PI_BIN` overrides the executable; `NAVARCH_PI_EXTRA_ARGS` adds CLI
 arguments. `--model` at connect pins this machine's model as for other agents.
 
-Bare model IDs use the generated `local` provider. Exact `provider/model`
+Bare model IDs first resolve a unique matching model in the operator's catalog;
+ambiguous matches require an explicit `provider/model`. Without a match, they
+use the generated `local` provider. Setting `NAVARCH_PI_LOCAL_BASE_URL` explicitly
+selects that generated provider. Exact `provider/model`
 references use the machine's existing Pi catalog and credentials from
 `~/.pi/agent/models.json` and `auth.json` (or `PI_CODING_AGENT_DIR`). Run
 `pi --list-models` to inspect that catalog. The UI puts the local default first

package/dist/adapters/pi.cjs

@@ -165,10 +165,20 @@ function attachPiOutput(result) {
     let costUsd;
     let sawUsage = false;
     let reportText = "";
+    let terminalError;
     for (const event of events) {
         const message = event.message;
+        if (event.type === "error") {
+            terminalError = typeof event.error === "string" ? event.error :
+                typeof event.errorMessage === "string" ? event.errorMessage : "Pi provider error";
+        }
         if (event.type !== "message_end" || !message || message.role !== "assistant")
             continue;
+        // Pi can settle an exhausted provider retry with process exit code zero.
+        // A later successful assistant message supersedes a recovered error.
+        terminalError = message.stopReason === "error" || message.errorMessage
+            ? typeof message.errorMessage === "string" ? message.errorMessage : "Pi provider error"
+            : undefined;
         const text = extractText(message.content);
         if (text.trim())
             reportText = text.trim();
@@ -193,6 +203,9 @@ function attachPiOutput(result) {
     }
     return {
         ...result,
+        ...(terminalError && result.exitCode === 0 && !result.timedOut && !result.killedByLeaseLoss
+            ? { exitCode: 1, stderr: `${result.stderr}${result.stderr ? "\n" : ""}Pi provider failed: ${terminalError}` }
+            : {}),
         ...(sawUsage
             ? {
                 // AdapterResult semantics: tokensIn folds every input category
@@ -269,13 +282,23 @@ async function runOnHost(options, args, local = false) {
                 const configPath = node_path_1.default.join(agentDir, "models.json");
                 const config = JSON.parse(await node_fs_1.promises.readFile(configPath, "utf8").catch(() => "{}"));
                 config.providers ??= {};
-                // Explicit provider/model references use the machine's catalog unchanged.
-                config.providers.local = {
-                    baseUrl: options.env.NAVARCH_PI_LOCAL_BASE_URL ?? process.env.NAVARCH_PI_LOCAL_BASE_URL ?? "http://127.0.0.1:8080/v1",
-                    api: "openai-completions", apiKey: "local",
-                    models: [{ id: model, reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 } }],
-                };
-                await node_fs_1.promises.writeFile(configPath, JSON.stringify(config), { mode: 0o600 });
+                const endpointOverride = options.env.NAVARCH_PI_LOCAL_BASE_URL ?? process.env.NAVARCH_PI_LOCAL_BASE_URL;
+                const matches = endpointOverride ? [] : Object.entries(config.providers).filter(([, provider]) => provider.models?.some((entry) => entry.id === model)).map(([name]) => name);
+                if (matches.length > 1)
+                    throw new Error(`Pi model ${model} matches multiple providers; select an explicit provider/model.`);
+                if (matches.length === 1) {
+                    args = [...args];
+                    args[args.lastIndexOf("--model") + 1] = `${matches[0]}/${model}`;
+                }
+                else {
+                    // Without a catalog match, retain the default local endpoint behavior.
+                    config.providers.local = {
+                        baseUrl: endpointOverride ?? "http://127.0.0.1:8080/v1",
+                        api: "openai-completions", apiKey: "local",
+                        models: [{ id: model, reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 } }],
+                    };
+                    await node_fs_1.promises.writeFile(configPath, JSON.stringify(config), { mode: 0o600 });
+                }
             }
             if (options.mcpConfigPath) {
                 await node_fs_1.promises.copyFile(options.mcpConfigPath, node_path_1.default.join(agentDir, "mcp.json"));

package/dist/session.cjs

@@ -378,6 +378,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             }
         }
         else if (runtime === "codex") {
+            if (process.platform === "linux") {
+                const tmpDir = (0, worktree_guard_cjs_1.sessionCodexTmpDir)(workDir);
+                await node_fs_1.promises.mkdir(tmpDir, { recursive: true, mode: 0o700 });
+                Object.assign(sessionEnv, { TMPDIR: tmpDir, TMP: tmpDir, TEMP: tmpDir });
+            }
             codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
                 workDir,
                 worktreePath: gitWorktree.worktreePath,

package/dist/worktree-guard.cjs

@@ -9,6 +9,7 @@ exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
 exports.macosDeveloperWriteRoots = macosDeveloperWriteRoots;
 exports.sessionGhConfigDir = sessionGhConfigDir;
+exports.sessionCodexTmpDir = sessionCodexTmpDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
 const node_path_1 = __importDefault(require("node:path"));
@@ -172,6 +173,9 @@ function macosDeveloperWriteRoots(env = process.env, platform = process.platform
 function sessionGhConfigDir(workDir) {
     return node_path_1.default.join(workDir, SESSION_GH_CONFIG_DIRNAME);
 }
+function sessionCodexTmpDir(workDir) {
+    return node_path_1.default.resolve(workDir, "tmp");
+}
 /**
  * Builds one-off Codex permission-profile arguments for a host session.
  *
@@ -180,33 +184,46 @@ function sessionGhConfigDir(workDir) {
  * this boundary. Authentication still comes from CODEX_HOME. The profile
  * grants only the runtime paths common tools need, the session worktree, the
  * shared Git directory, temp space, and operator-approved extra roots. The
- * surrounding Navarch workspace is denied, then the more-specific current
- * worktree/repository grants reopen only this session's paths. The worktree
+ * surrounding Navarch workspace is denied (implicitly on Linux), with only
+ * this session's paths granted access. The worktree
  * is marked untrusted for configuration purposes so a checked-in legacy
  * sandbox_mode cannot disable the generated permission profile; repository
  * instructions such as AGENTS.md still load normally.
  */
-function codexWorktreeGuardArgs(options) {
+function codexWorktreeGuardArgs(options, platform = process.platform) {
+    const workspaceRoot = node_path_1.default.resolve(options.workspaceRoot);
+    const linux = platform === "linux";
+    // On Linux, a denied ancestor is an empty read-only bwrap mount. Codex
+    // can then try to protect a linked worktree's gitdir before reopening the
+    // bare repository, failing to mkdir repository.git/worktrees/repo beneath
+    // that mount. Use restricted-read's implicit deny instead. Broad temp or
+    // ancestor grants would expose the workspace without the explicit mask,
+    // so Linux gets only a session temp root and non-overlapping extra roots.
     const filesystem = {
         ":minimal": "read",
-        ":tmpdir": "write",
-        ":slash_tmp": "write",
-        [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
+        ...(linux
+            ? { [sessionCodexTmpDir(options.workDir)]: "write" }
+            : {
+                ":tmpdir": "write",
+                ":slash_tmp": "write",
+                [workspaceRoot]: "deny",
+            }),
         [node_path_1.default.resolve(options.worktreePath)]: "write",
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
         [sessionGhConfigDir(options.workDir)]: "read",
     };
-    for (const root of codexToolReadRoots()) {
+    const overlapsWorkspace = (root) => isPathInside(root, workspaceRoot) || (linux && isPathInside(workspaceRoot, root));
+    for (const root of codexToolReadRoots(process.env, platform)) {
         const resolved = node_path_1.default.resolve(root);
-        if (isPathInside(resolved, node_path_1.default.resolve(options.workspaceRoot)))
+        if (overlapsWorkspace(resolved))
             continue;
         filesystem[resolved] = "read";
     }
-    for (const root of [...macosDeveloperWriteRoots(), ...(options.extraRoots ?? [])]) {
+    for (const root of [...macosDeveloperWriteRoots(process.env, platform), ...(options.extraRoots ?? [])]) {
         const resolved = node_path_1.default.resolve(root);
         // Match the Claude hook's denied-root precedence: an extra root cannot
         // reopen sibling sessions or metadata inside the Navarch workspace.
-        if (isPathInside(resolved, node_path_1.default.resolve(options.workspaceRoot)))
+        if (overlapsWorkspace(resolved))
             continue;
         filesystem[resolved] = "write";
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.80",
+  "version": "0.1.82",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",