@sagentlab/navarch-runtime 0.1.93 → 0.1.96

package/README.md

@@ -330,13 +330,14 @@ own budgets. An absolute limit covers all guidance/remediation turns within the
 claim, rather than resetting with each turn. These are runtime limits, not
 provider spending caps.
 
-After a watchdog stop or lease loss during a turn, before worktree cleanup, the runtime attempts a private
+After a watchdog stop, lease loss during a turn, or exhausted delivery correction
+turns, before worktree cleanup, the runtime attempts a private
 local recovery checkpoint at
 `<workspaceRoot>/checkpoints/<project>/<task>/<session>/`. It contains a Git
 bundle of committed history, a binary patch for dirty tracked files, untracked
 non-ignored files, and recovery instructions. The bundle excludes repository
 configuration and broker credentials. Checkpoints are not pushed or uploaded;
-timeout reports and runtime logs name their location. They survive session cleanup and need
+failure reports and runtime logs name their location. They survive session cleanup and need
 manual recovery and removal on that machine. Ignored files, agent conversation
 state, and checkpoints across machine/disk loss are not provided.
 
@@ -504,7 +505,9 @@ as an explicit read-only mount.
 - **Codex:** the runtime passes a one-off native permission profile with
   `approval_policy="on-request"` and `approvals_reviewer="auto_review"`.
   Codex's OS sandbox grants read/write access only to the allowed roots and
-  denies the surrounding multi-session workspace. Its network policy allows
+  denies the surrounding multi-session workspace. After preparing the worktree,
+  the runtime explicitly grants its resolved linked Git metadata directory write
+  access so staging and committing work inside the sandbox. Its network policy allows
   GitHub and GitHub-hosted content so authenticated `gh` and git operations
   required by the task stay inside the sandbox. Other destinations remain
   blocked and eligible escalations are decided by the automatic reviewer

package/dist/delivery.cjs

@@ -146,6 +146,10 @@ function describeBranch(branch) {
  * task.
  */
 function renderDeliveryCorrectionPrompt(args) {
+    const report = args.previousReport.trim();
+    const clippedReport = report.length > 8_000
+        ? `${report.slice(0, 8_000)}\n\n[... truncated]`
+        : report;
     return [
         args.originalPrompt.trim(),
         "",
@@ -157,10 +161,26 @@ function renderDeliveryCorrectionPrompt(args) {
         "so your earlier edits, commits, and branch are all still here — start with `git status` and",
         "`git log --oneline` and continue from there rather than redoing the work.",
         "",
-        "Finish the delivery chain: commit the work, push the branch, and open the pull request.",
-        "If part of the task genuinely cannot be completed, still deliver what does work as a pull request",
-        "and state plainly in the description what is missing and why.",
+        "Inspect tracked and untracked changes before deciding what is undelivered work. Preserve required",
+        "evidence in task artifacts, remove only temporary files you created (such as `.review-*/` scratch",
+        "directories), and restore only tracked edits you made solely for local checks. Do not delete",
+        "unfamiliar or pre-existing changes, hide leftovers with ignore rules, or commit scratch files.",
+        ...(args.taskType === "review"
+            ? [
+                "This is a read-only review task. The generic delivery failure does not authorize commits,",
+                "pushes, rebases, merges, or a new PR. A dirty worktree may contain only review scratch files.",
+                "Check whether the native review already exists for this task and reviewed head. If it does,",
+                "reuse that review and its matching attestation; do not file a duplicate or implement findings.",
+                "If it does not, finish filing the review required by the original task. Leave a clean worktree.",
+            ]
+            : [
+                "Follow the original task's delivery contract. If it requires a PR, commit the intended work,",
+                "push the branch, and open or update the PR. A report-only task does not need a new PR.",
+                "If part of a PR task cannot be completed, deliver what does work and describe the gap.",
+            ]),
         "",
-        "This session's worktree is deleted when the session ends. Work that is not pushed is lost.",
+        "Your final report replaces the previous one. Restate it in full in the required format, preserving",
+        "the verdict, reviewed head, findings, and validation limitations. Do not claim delivery you cannot verify.",
+        ...(clippedReport ? ["", "### Previous turn's final report", "", clippedReport] : []),
     ].join("\n");
 }

package/dist/exit-conditions.cjs

@@ -359,7 +359,10 @@ function mapExitCondition(result) {
     // including when that response says the task could not start. Treat an
     // explicit leading blocked verdict as a failed lease so the dispatcher can
     // retry/escalate it instead of falsely moving unfinished work to Done.
-    if (/^blocked(?:\s|:|$)/i.test(reportText.trim())) {
+    // Build agents also use an explicit outcome marker. A zero process exit
+    // means the conversation finished, not that the requested build succeeded.
+    if (/^blocked(?:\s|:|$)/i.test(reportText.trim()) ||
+        /^Build outcome:\s*(?:FAILED|BLOCKED)\b/i.test(reportText.trim())) {
         return {
             leaseOutcome: "failed",
             exitStatus: "failed",

package/dist/prompt.cjs

@@ -5,7 +5,7 @@ exports.renderGuidanceCorrectionPrompt = renderGuidanceCorrectionPrompt;
 exports.renderCompletionRemediationPrompt = renderCompletionRemediationPrompt;
 exports.renderHostedCheckpointNote = renderHostedCheckpointNote;
 const CODE_GRAPH_GUIDANCE = "For JS/TS dependency inspection, the runtime provides `navarch-runtime code-graph --query <symbol-or-file> --mode search|callers|callees|impact --commit HEAD`. If the runtime is not on PATH, use its installed entry point; do not install another copy mid-task. Results describe committed source and include commit/freshness warnings; inspect current files for uncommitted changes and unresolved dependencies.";
-const PROCESS_GUIDANCE = "Process management: this host may run other agent sessions. Keep the PID or tool handle of each preview server you start and stop only that owned process. Never use broad process-name or command-line matching (pkill, killall) to clean up servers: the agent launcher carries the task prompt in its arguments and can match those patterns, terminating your own session. Use a different port when a port is occupied by a process you do not own. Keep scratch files in the current worktree; paths in previous transcripts belong to earlier sessions.";
+const PROCESS_GUIDANCE = "Process management: this host may run other agent sessions. Keep the PID or tool handle of each preview server you start and stop only that owned process. Never use broad process-name or command-line matching (pkill, killall) to clean up servers: the agent launcher carries the task prompt in its arguments and can match those patterns, terminating your own session. Use a different port when a port is occupied by a process you do not own. Keep scratch files in the current worktree; paths in previous transcripts belong to earlier sessions. Before your final report, inspect `git status --short`, including untracked files. Preserve required evidence in task artifacts, then remove only temporary files you created and restore only tracked edits you made solely for local checks. Do not delete unfamiliar or pre-existing changes, hide leftovers with ignore rules, or commit scratch files merely to make the worktree clean. Review tasks deliver a native review and attestation, never commits, pushes, or a new PR.";
 /** Overrides the playbooks' "default branch" PR base when the project sets a working branch. */
 function workingBranchNote(workingBranch) {
     if (!workingBranch)

package/dist/session.cjs

@@ -232,13 +232,14 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
     let retainWorktree = false;
     let heartbeatInFlight = null;
     let heartbeatWorkspaceUpdate = null;
+    let completingLease = false;
     const sessionOutcome = {};
-    const checkpointForRecovery = async (result) => {
+    const checkpointForRecovery = async (result, reason) => {
         if (result.checkpointPath || result.retainedWorktreePath)
             return;
         try {
             result.checkpointPath = await gitWorktree.saveCheckpoint();
-            log.warn(`session ${leaseId} stopped for ${leaseLost ? "lease loss" : result.capacityError ? "provider capacity" : result.timeoutReason ?? "duration"}; recovery checkpoint: ${result.checkpointPath}`);
+            log.warn(`session ${leaseId} stopped for ${reason ?? (leaseLost ? "lease loss" : result.capacityError ? "provider capacity" : result.timeoutReason ?? "duration")}; recovery checkpoint: ${result.checkpointPath}`);
         }
         catch (error) {
             retainWorktree = true;
@@ -285,7 +286,15 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 log.warn(`lease heartbeat failed for ${leaseId}: ${String(err)} — retrying on the next heartbeat while the confirmed lease remains valid.`);
                 return;
             }
-            log.warn(`lease heartbeat failed for ${leaseId}: ${String(err)} — killing session.`);
+            if (completingLease && isTerminalLeaseHeartbeatError(err)) {
+                // Completion can release the lease before its HTTP response arrives.
+                // Keep awaiting/re-sending that report to resolve the ambiguous write;
+                // there is no agent turn to kill during this phase.
+                log.info(`lease ${leaseId} is no longer active while completion is pending; awaiting completion acknowledgement.`);
+            }
+            else {
+                log.warn(`lease heartbeat failed for ${leaseId}: ${String(err)} — killing session.`);
+            }
             leaseLost = true;
             leaseGone = isTerminalLeaseHeartbeatError(err);
             heartbeatGuard.stop();
@@ -385,14 +394,6 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 await node_fs_1.promises.mkdir(tmpDir, { recursive: true, mode: 0o700 });
                 Object.assign(sessionEnv, { TMPDIR: tmpDir, TMP: tmpDir, TEMP: tmpDir });
             }
-            codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
-                workDir,
-                worktreePath: gitWorktree.worktreePath,
-                repositoryPath: gitWorktree.repositoryPath,
-                workspaceRoot: config.workspaceRoot,
-                extraRoots: config.guardExtraRoots,
-                codexBin: config.codexBin,
-            });
         }
         else if (runtime === "gemini") {
             geminiGuardMounts = (0, worktree_guard_cjs_1.geminiSandboxMounts)({
@@ -465,6 +466,16 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
             log.warn(`hosted checkpoint for ${leaseId} could not be restored: ` +
                 `${(0, redact_cjs_1.redactText)(gitWorktree.hostedCheckpointRestoreFailure, registry.list())}; starting without it.`);
         }
+        if (config.sandboxMode === "host" && config.worktreeGuard && runtime === "codex") {
+            codexGuardArgs = (0, worktree_guard_cjs_1.codexWorktreeGuardArgs)({
+                workDir,
+                worktreePath: gitWorktree.worktreePath,
+                repositoryPath: gitWorktree.repositoryPath,
+                workspaceRoot: config.workspaceRoot,
+                extraRoots: config.guardExtraRoots,
+                codexBin: config.codexBin,
+            });
+        }
         const restoredCheckpoint = gitWorktree.restoredHostedCheckpoint;
         if (restoredCheckpoint) {
             log.info(`resumed hosted checkpoint ${restoredCheckpoint.sha.slice(0, 12)} for ${leaseId} ` +
@@ -695,17 +706,24 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                             `restarting agent turn ${deliveryCorrectionRetries}/${DELIVERY_CORRECTION_RETRIES} in the same worktree.`);
                         nextPrompt = (0, delivery_cjs_1.renderDeliveryCorrectionPrompt)({
                             originalPrompt: runPrompt,
+                            taskType: task.task_type,
+                            // The completion summary is capped at 500 characters. Preserve
+                            // the final prose from adapters that only return stdout as well.
+                            previousReport: (0, redact_cjs_1.redactText)(result.reportText ?? (0, exit_conditions_cjs_1.parseClaudeJsonResult)(result.stdout)?.result ?? result.stdout, registry.list()),
                             reason: delivery.reason,
                             attempt: deliveryCorrectionRetries,
                             maxAttempts: DELIVERY_CORRECTION_RETRIES,
                         });
                         continue;
                     }
+                    await checkpointForRecovery(result, "incomplete delivery");
                     deliveryFailureSummary =
                         `Session ended without delivering the task: ${delivery.reason}. ` +
                             `${deliveryCorrectionRetries} correction turn(s) did not recover it. ` +
-                            "The session worktree is deleted at teardown. Pushed commits remain on origin; " +
-                            "uncommitted or unpushed work may be lost. The task needs another attempt.";
+                            (result.checkpointPath
+                                ? `Local recovery checkpoint: ${result.checkpointPath}. `
+                                : `Recovery worktree retained: ${result.retainedWorktreePath}. `) +
+                            "The task needs another attempt.";
                     log.warn(`failing ${leaseId}: ${deliveryFailureSummary}`);
                     mapping.leaseOutcome = "failed";
                     mapping.exitStatus = "failed";
@@ -757,6 +775,7 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 transcript_url: completion.transcript_url,
             };
             try {
+                completingLease = true;
                 await (0, completion_retry_cjs_1.completeWithTransientRetry)(() => api.completeLease(leaseId, completion), {
                     onRetry: (attempt, delayMs, err) => log.warn(`completion for ${leaseId} did not reach the control plane (${(0, redact_cjs_1.redactText)(String(err), knownSecrets)}); re-sending in ${delayMs / 1000}s (${attempt}).`),
                 });
@@ -778,10 +797,11 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 if (!rejection)
                     throw err;
                 const redactedRejection = (0, redact_cjs_1.redactText)(rejection.message, knownSecrets);
+                const rejectionDetail = describeResponseBody(`${(0, redact_cjs_1.redactText)(rejection.code, knownSecrets)}: ${redactedRejection}`);
                 const remediable = mapping.leaseOutcome === "completed" && rejection.remediable;
                 if (remediable && completionRemediationRetries < COMPLETION_REMEDIATION_RETRIES) {
                     completionRemediationRetries += 1;
-                    log.warn(`completion for ${leaseId} needs more work; restarting agent turn ${completionRemediationRetries}/${COMPLETION_REMEDIATION_RETRIES} in the same worktree.`);
+                    log.warn(`completion for ${leaseId} needs more work (${rejectionDetail}); restarting agent turn ${completionRemediationRetries}/${COMPLETION_REMEDIATION_RETRIES} in the same worktree.`);
                     // A new turn is a fresh agent invocation: the rejection alone would
                     // reach an agent that has never seen the task.
                     nextPrompt = (0, prompt_cjs_1.renderCompletionRemediationPrompt)({
@@ -794,22 +814,24 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                     continue;
                 }
                 if (remediable) {
-                    log.warn(`completion for ${leaseId} is still not ready after ${COMPLETION_REMEDIATION_RETRIES} retries; failing with the control-plane rejection.`);
+                    log.warn(`completion for ${leaseId} is still not ready after ${COMPLETION_REMEDIATION_RETRIES} retries (${rejectionDetail}); failing with the control-plane rejection.`);
                 }
                 else {
                     // Not something another turn can fix (e.g. review_evidence_tampered).
                     // Fail the lease once, keeping this attempt's real report, cost and
                     // evidence — this is a rejected attempt, not a crashed session.
-                    log.error(`completion for ${leaseId} was rejected as ${rejection.code}, which is not remediable; failing the lease.`);
+                    log.error(`completion for ${leaseId} was rejected (${rejectionDetail}), which is not remediable; failing the lease.`);
                 }
                 try {
                     await (0, completion_retry_cjs_1.completeWithTransientRetry)(() => api.completeLease(leaseId, {
                         ...completion,
                         status: "failed",
-                        report: remediable
-                            ? redactedRejection
-                            : `${redactedRejection}\n\n---\n\n${completion.report}`,
-                        failure_summary: redactedRejection,
+                        report: `${redactedRejection}\n\n---\n\n${completion.report}`,
+                        // Keep the agent's blocker first: the API bounds failure_summary,
+                        // and retry attribution must not lose it behind a delivery error.
+                        failure_summary: remediable
+                            ? `${completion.report.slice(0, 1000)}\n\nControl-plane rejection:\n${redactedRejection.slice(0, 800)}`
+                            : redactedRejection,
                         exit_status: "failed",
                     }));
                 }
@@ -824,6 +846,9 @@ async function runClaimedSession(deps, claimed, sessionId, lifecycle) {
                 }
                 break;
             }
+            finally {
+                completingLease = false;
+            }
         }
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.93",
+  "version": "0.1.96",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",