@sagentlab/navarch-runtime 0.1.81 → 0.1.83

package/README.md

@@ -543,6 +543,15 @@ The Claude hook is a strong guardrail rather than a hard security boundary
 because shell paths are screened lexically. Codex's permission profile is
 enforced by its OS sandbox. For container-grade whole-process isolation use
 `NAVARCH_SANDBOX_MODE=docker`; neither host guard is installed in Docker mode.
+On Linux, Codex uses an explicit allowlist without a denied workspace-parent
+mount, avoiding bubblewrap startup failures with linked Git worktrees. Its
+`TMPDIR`, `TMP`, and `TEMP` point to a private `tmp` directory inside the session;
+the profile does not grant all of `/tmp`. Extra/tool roots that contain the
+workspace are omitted on Linux so they cannot expose sibling sessions or
+session metadata. This also applies when the workspace itself lives under `/tmp`.
+To verify the linked-worktree boundary on a Linux host with Codex installed,
+run `NAVARCH_TEST_REAL_CODEX=1 npm test -- tests/codex-linux-sandbox.test.cts`
+from `runtime/`. The smoke test uses local shell commands and makes no model calls.
 An operator-supplied `--settings` in `NAVARCH_CLAUDE_EXTRA_ARGS`, or an
 explicit Codex permission/sandbox option in `NAVARCH_CODEX_EXTRA_ARGS`, takes
 precedence over the generated policy.

package/dist/exit-conditions.cjs

@@ -39,6 +39,7 @@ function parseClaudeJsonResult(stdout) {
     const isUsableResult = (value) => typeof value === "object" &&
         value !== null &&
         !Array.isArray(value) &&
+        (!("result" in value) || typeof value.result === "string") &&
         ("result" in value || "usage" in value || "cost_usd" in value || "total_cost_usd" in value);
     try {
         const parsed = JSON.parse(trimmed);

package/dist/session.cjs

@@ -378,6 +378,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             }
         }
         else if (runtime === "codex") {
+            if (process.platform === "linux") {
+                const tmpDir = (0, worktree_guard_cjs_1.sessionCodexTmpDir)(workDir);
+                await node_fs_1.promises.mkdir(tmpDir, { recursive: true, mode: 0o700 });
+                Object.assign(sessionEnv, { TMPDIR: tmpDir, TMP: tmpDir, TEMP: tmpDir });
+            }
             codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
                 workDir,
                 worktreePath: gitWorktree.worktreePath,

package/dist/worktree-guard.cjs

@@ -9,6 +9,7 @@ exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
 exports.macosDeveloperWriteRoots = macosDeveloperWriteRoots;
 exports.sessionGhConfigDir = sessionGhConfigDir;
+exports.sessionCodexTmpDir = sessionCodexTmpDir;
 exports.codexWorktreeGuardArgs = codexWorktreeGuardArgs;
 exports.geminiSandboxMounts = geminiSandboxMounts;
 const node_path_1 = __importDefault(require("node:path"));
@@ -172,6 +173,9 @@ function macosDeveloperWriteRoots(env = process.env, platform = process.platform
 function sessionGhConfigDir(workDir) {
     return node_path_1.default.join(workDir, SESSION_GH_CONFIG_DIRNAME);
 }
+function sessionCodexTmpDir(workDir) {
+    return node_path_1.default.resolve(workDir, "tmp");
+}
 /**
  * Builds one-off Codex permission-profile arguments for a host session.
  *
@@ -180,33 +184,46 @@ function sessionGhConfigDir(workDir) {
  * this boundary. Authentication still comes from CODEX_HOME. The profile
  * grants only the runtime paths common tools need, the session worktree, the
  * shared Git directory, temp space, and operator-approved extra roots. The
- * surrounding Navarch workspace is denied, then the more-specific current
- * worktree/repository grants reopen only this session's paths. The worktree
+ * surrounding Navarch workspace is denied (implicitly on Linux), with only
+ * this session's paths granted access. The worktree
  * is marked untrusted for configuration purposes so a checked-in legacy
  * sandbox_mode cannot disable the generated permission profile; repository
  * instructions such as AGENTS.md still load normally.
  */
-function codexWorktreeGuardArgs(options) {
+function codexWorktreeGuardArgs(options, platform = process.platform) {
+    const workspaceRoot = node_path_1.default.resolve(options.workspaceRoot);
+    const linux = platform === "linux";
+    // On Linux, a denied ancestor is an empty read-only bwrap mount. Codex
+    // can then try to protect a linked worktree's gitdir before reopening the
+    // bare repository, failing to mkdir repository.git/worktrees/repo beneath
+    // that mount. Use restricted-read's implicit deny instead. Broad temp or
+    // ancestor grants would expose the workspace without the explicit mask,
+    // so Linux gets only a session temp root and non-overlapping extra roots.
     const filesystem = {
         ":minimal": "read",
-        ":tmpdir": "write",
-        ":slash_tmp": "write",
-        [node_path_1.default.resolve(options.workspaceRoot)]: "deny",
+        ...(linux
+            ? { [sessionCodexTmpDir(options.workDir)]: "write" }
+            : {
+                ":tmpdir": "write",
+                ":slash_tmp": "write",
+                [workspaceRoot]: "deny",
+            }),
         [node_path_1.default.resolve(options.worktreePath)]: "write",
         [node_path_1.default.resolve(options.repositoryPath)]: "write",
         [sessionGhConfigDir(options.workDir)]: "read",
     };
-    for (const root of codexToolReadRoots()) {
+    const overlapsWorkspace = (root) => isPathInside(root, workspaceRoot) || (linux && isPathInside(workspaceRoot, root));
+    for (const root of codexToolReadRoots(process.env, platform)) {
         const resolved = node_path_1.default.resolve(root);
-        if (isPathInside(resolved, node_path_1.default.resolve(options.workspaceRoot)))
+        if (overlapsWorkspace(resolved))
             continue;
         filesystem[resolved] = "read";
     }
-    for (const root of [...macosDeveloperWriteRoots(), ...(options.extraRoots ?? [])]) {
+    for (const root of [...macosDeveloperWriteRoots(process.env, platform), ...(options.extraRoots ?? [])]) {
         const resolved = node_path_1.default.resolve(root);
         // Match the Claude hook's denied-root precedence: an extra root cannot
         // reopen sibling sessions or metadata inside the Navarch workspace.
-        if (isPathInside(resolved, node_path_1.default.resolve(options.workspaceRoot)))
+        if (overlapsWorkspace(resolved))
             continue;
         filesystem[resolved] = "write";
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.81",
+  "version": "0.1.83",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",