@sagentlab/navarch-runtime 0.1.83 → 0.1.84

package/README.md

@@ -549,6 +549,11 @@ mount, avoiding bubblewrap startup failures with linked Git worktrees. Its
 the profile does not grant all of `/tmp`. Extra/tool roots that contain the
 workspace are omitted on Linux so they cannot expose sibling sessions or
 session metadata. This also applies when the workspace itself lives under `/tmp`.
+Because bubblewrap starts from an empty `/` and Codex re-executes its own binary
+inside it, the profile also grants read access to the Codex executable's
+install directory (resolved from `NAVARCH_CODEX_BIN` or `PATH`, following
+symlinks) plus mise and nvm tool installs, so a Codex or Node installed under
+`$HOME` still starts. `$HOME` and `CODEX_HOME` themselves are never granted.
 To verify the linked-worktree boundary on a Linux host with Codex installed,
 run `NAVARCH_TEST_REAL_CODEX=1 npm test -- tests/codex-linux-sandbox.test.cts`
 from `runtime/`. The smoke test uses local shell commands and makes no model calls.

package/dist/browser-probe.cjs

@@ -155,6 +155,7 @@ function codexSandboxProbeArgs(config, roots) {
         repositoryPath: node_path_1.default.join(workspaceRoot, "repo"),
         workspaceRoot,
         extraRoots: [...config.guardExtraRoots, ...roots.readRoots],
+        codexBin: config.codexBin,
     }).filter((arg) => arg !== "--ignore-user-config");
 }
 const PROBE_SCRIPT = `
@@ -200,9 +201,15 @@ async function probeCodexSandbox(config, deps) {
             return null;
         const output = `${result.stderr}\n${result.stdout}`;
         if (!result.stdout.includes(PROBE_START_MARKER)) {
+            // bwrap could not find the program it was asked to start inside the
+            // sandbox view: a path outside the granted read roots, not an old CLI.
+            const hidden = /bwrap: execvp .*No such file or directory/.test(output);
             return ("Could not verify a browser inside the Codex sandbox: `codex sandbox` did not run the probe " +
                 `(${result.timedOut ? "timed out" : output.trim() ? summarizeLaunchFailure(output) : `exit ${result.code}`}). ` +
-                "Update the Codex CLI, or run browser tasks with another agent.");
+                (hidden
+                    ? "The sandbox cannot see that executable; add its install directory to NAVARCH_GUARD_EXTRA_ROOTS, " +
+                        "or run browser tasks with another agent."
+                    : "Update the Codex CLI, or run browser tasks with another agent."));
         }
         const detail = result.timedOut ? "the launch timed out." : summarizeLaunchFailure(output);
         const machPort = /bootstrap_check_in|MachPortRendezvous|mach_port_rendezvous/i.test(output);

package/dist/session.cjs

@@ -389,6 +389,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 repositoryPath: gitWorktree.repositoryPath,
                 workspaceRoot: config.workspaceRoot,
                 extraRoots: config.guardExtraRoots,
+                codexBin: config.codexBin,
             });
         }
         else if (runtime === "gemini") {

package/dist/worktree-guard.cjs

@@ -7,6 +7,7 @@ exports.guardHookScriptPath = guardHookScriptPath;
 exports.readClaudeApiKeyHelper = readClaudeApiKeyHelper;
 exports.prepareWorktreeGuard = prepareWorktreeGuard;
 exports.codexToolReadRoots = codexToolReadRoots;
+exports.codexExecutableReadRoots = codexExecutableReadRoots;
 exports.macosDeveloperWriteRoots = macosDeveloperWriteRoots;
 exports.sessionGhConfigDir = sessionGhConfigDir;
 exports.sessionCodexTmpDir = sessionCodexTmpDir;
@@ -131,9 +132,75 @@ function codexToolReadRoots(env = process.env, platform = process.platform) {
         "/System/Library/CoreServices/SystemAppearance.bundle",
         node_path_1.default.join(homeDir, "Library", "Caches", "ms-playwright"),
         node_path_1.default.join(homeDir, ".cache", "ms-playwright"),
+        // Per-user toolchain installs (node/npm, Codex itself). Shell commands
+        // under the Linux sandbox see only granted roots, so a mise- or
+        // nvm-managed `node` on PATH is otherwise "command not found".
+        node_path_1.default.join(miseDataDir(env, homeDir), "installs"),
+        node_path_1.default.join(env.NVM_DIR?.trim() || node_path_1.default.join(homeDir, ".nvm"), "versions"),
         ...(platform === "darwin" ? MACOS_TOOLCHAIN_READ_ROOTS : []),
     ];
 }
+function miseDataDir(env, homeDir) {
+    const explicit = env.MISE_DATA_DIR?.trim();
+    if (explicit)
+        return explicit;
+    return node_path_1.default.join(env.XDG_DATA_HOME?.trim() || node_path_1.default.join(homeDir, ".local", "share"), "mise");
+}
+/**
+ * Directories holding the Codex executable itself.
+ *
+ * On Linux a restricted-read profile starts bwrap from an empty `/` with only
+ * granted roots mounted, and Codex re-executes its own binary inside that view
+ * to install seccomp. A CLI installed outside `:minimal` (mise, nvm, an npm
+ * prefix under $HOME) then fails every sandboxed command with
+ * `bwrap: execvp <codex>: No such file or directory`. Grants the PATH entry,
+ * its symlink target's directory, and an npm package root (whose vendored
+ * native binary is what actually re-executes). Never returns $HOME, CODEX_HOME,
+ * or an ancestor of either: those would expose credentials read-only.
+ */
+function codexExecutableReadRoots(bin, env = process.env) {
+    const resolved = resolveExecutable(bin, env);
+    if (!resolved)
+        return [];
+    let real = resolved;
+    try {
+        real = (0, node_fs_1.realpathSync)(resolved);
+    }
+    catch {
+        // Keep the logical path; bwrap mounts it as given.
+    }
+    const roots = [node_path_1.default.dirname(resolved), node_path_1.default.dirname(real)];
+    const packageRoot = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//.exec(real)?.[1];
+    if (packageRoot)
+        roots.push(packageRoot);
+    const homeDir = env.HOME?.trim() || node_os_1.default.homedir();
+    const sensitive = [homeDir, env.CODEX_HOME?.trim() || node_path_1.default.join(homeDir, ".codex")].flatMap((dir) => {
+        try {
+            return [node_path_1.default.resolve(dir), (0, node_fs_1.realpathSync)(dir)];
+        }
+        catch {
+            return [node_path_1.default.resolve(dir)];
+        }
+    });
+    return [...new Set(roots.map((root) => node_path_1.default.resolve(root)))].filter((root) => !sensitive.some((target) => isPathInside(target, root)));
+}
+function resolveExecutable(bin, env) {
+    const candidates = bin.includes("/")
+        ? [node_path_1.default.resolve(bin)]
+        : (env.PATH ?? "").split(node_path_1.default.delimiter).filter(Boolean).map((dir) => node_path_1.default.join(dir, bin));
+    for (const candidate of candidates) {
+        try {
+            if (!(0, node_fs_1.statSync)(candidate).isFile())
+                continue;
+            (0, node_fs_1.accessSync)(candidate, node_fs_1.constants.X_OK);
+            return node_path_1.default.resolve(candidate);
+        }
+        catch {
+            // Not here; keep searching PATH.
+        }
+    }
+    return undefined;
+}
 /**
  * World-readable macOS toolchain locations. `xcrun simctl` / `xcodebuild`
  * load /Library/Developer/PrivateFrameworks/CoreSimulator.framework and the
@@ -213,7 +280,11 @@ function codexWorktreeGuardArgs(options, platform = process.platform) {
         [sessionGhConfigDir(options.workDir)]: "read",
     };
     const overlapsWorkspace = (root) => isPathInside(root, workspaceRoot) || (linux && isPathInside(workspaceRoot, root));
-    for (const root of codexToolReadRoots(process.env, platform)) {
+    const readRoots = [
+        ...codexToolReadRoots(process.env, platform),
+        ...(linux && options.codexBin ? codexExecutableReadRoots(options.codexBin) : []),
+    ];
+    for (const root of readRoots) {
         const resolved = node_path_1.default.resolve(root);
         if (overlapsWorkspace(resolved))
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.83",
+  "version": "0.1.84",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",