@sagentlab/navarch-runtime 0.1.86 → 0.1.87

package/README.md

@@ -691,6 +691,14 @@ post-tool answer as the report, and reads aggregate `input_tokens` and
 `output_tokens` from the terminal `result` event. Gemini does not report USD
 cost, so an unknown value remains absent rather than becoming zero.
 
+Gemini's native sandbox launcher converts piped stdin back into a `--prompt`
+argument for its child. The adapter rejects prompts of 128 KiB or more when
+that sandbox is enabled, with an explicit diagnostic; reducing context or
+selecting another runtime preserves the worktree boundary. Navarch Docker
+mode disables the nested Gemini sandbox by default and can still pipe larger
+prompts. All Gemini runs reject prompts above 8 MiB because Gemini's stdin
+reader silently truncates input beyond that limit. These checks use UTF-8 bytes.
+
 The OpenCode adapter uses `opencode run --format json` with the prompt on
 stdin, and normalizes `text` and `step_finish` JSONL events into
 the shared report/token/cost boundary. It translates the lease MCP document
@@ -722,6 +730,9 @@ rejects any single argv or environment string over 128 KiB
 (`MAX_ARG_STRLEN`), so an argv prompt made large review sessions fail with
 `spawn E2BIG` before the agent started. Docker-mode sessions forward the same
 stdin through `docker exec -i`.
+Gemini's own sandbox relaunch is an exception to this transport guarantee,
+as described above; moving the initial spawn to stdin does not remove its
+internal argv limit.
 
 ## Architecture
 

package/dist/adapters/gemini.cjs

@@ -16,10 +16,20 @@ const kill_agent_cjs_1 = require("../kill-agent.cjs");
  * temporary system-settings file and restricts the run to those server names.
  *
  * The prompt arrives on stdin rather than `--prompt`: Gemini runs headlessly
- * whenever stdin is not a TTY and uses the piped text as the prompt, and
- * Linux rejects any single argv string over 128 KiB (`spawn E2BIG`).
+ * whenever stdin is not a TTY and uses the piped text as the prompt. Its
+ * native sandbox puts stdin back into argv, so that path still has Linux's
+ * 128 KiB per-string limit. Gemini also caps stdin at 8 MiB.
  */
 async function runGeminiAdapter(options) {
+    if (options.signal?.aborted) {
+        return { exitCode: null, timedOut: false, killedByLeaseLoss: true, stdout: "", stderr: "" };
+    }
+    const promptBytes = Buffer.byteLength(options.prompt, "utf8");
+    // Gemini's readStdin() silently truncates at 8 MiB. Reject before any
+    // settings writes or process launch rather than execute a partial task.
+    if (promptBytes > 8 * 1024 * 1024) {
+        return inputFailure(`Gemini CLI stdin is limited to 8 MiB; the task prompt is ${promptBytes} bytes. Reduce the context bundle or select another runtime.`);
+    }
     const args = [];
     const env = { ...options.env };
     if (!hasArg(options.extraArgs, "--output-format", "-o")) {
@@ -57,12 +67,41 @@ async function runGeminiAdapter(options) {
     args.push(...options.extraArgs);
     if (options.model)
         args.push("--model", options.model);
+    // Gemini's sandbox launcher reads stdin and injects it back into --prompt
+    // for its child process (packages/cli/src/gemini.tsx injectStdinIntoArgs).
+    // Moving our first spawn's prompt to stdin cannot fix that second spawn.
+    // Check the effective flag, including operator overrides, without disabling
+    // the worktree guard. Even on macOS a Docker sandbox may launch on Linux.
+    if (geminiSandboxEnabled(args) && promptBytes >= 128 * 1024) {
+        return inputFailure(`Gemini CLI re-encodes stdin as --prompt when launching its native sandbox; the ${promptBytes}-byte task prompt exceeds Linux's argv limit. Reduce the context bundle or select another runtime that supports large prompts in its sandbox.`);
+    }
     const runOptions = { ...options, env };
     const raw = runOptions.dockerExec
         ? await runViaDocker(runOptions, args)
         : await runOnHost(runOptions, args);
     return attachGeminiOutput(raw);
 }
+function inputFailure(stderr) {
+    return { exitCode: 1, timedOut: false, killedByLeaseLoss: false, stdout: "", stderr };
+}
+function geminiSandboxEnabled(args) {
+    // There is always a generated --sandbox flag unless extraArgs supplies one.
+    // Like yargs, later explicit values override earlier ones.
+    let enabled = false;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--sandbox" || arg === "-s") {
+            enabled = args[index + 1] !== "false";
+        }
+        else if (arg.startsWith("--sandbox=") || arg.startsWith("-s=")) {
+            enabled = arg.slice(arg.indexOf("=") + 1) !== "false";
+        }
+        else if (arg === "--no-sandbox") {
+            enabled = false;
+        }
+    }
+    return enabled;
+}
 function hasArg(args, ...flags) {
     return args.some((arg) => flags.some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.86",
+  "version": "0.1.87",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",