@sagentlab/navarch-runtime weekly downloads statistics

navarch-runtime

Conversation mirror isolation and lifecycle fixes are included in runtime 0.1.115.

Managed visual evidence

Host-mode build, verify, and QA leases requiring browser-use receive a navarch_browser MCP server with capture_visual_evidence in Codex, Claude, Antigravity, OpenCode, and ACP sessions. It runs Chromium in the runtime process's environment, outside the coding agent's OS sandbox, with a fresh browser context for desktop and touch-enabled mobile captures. It neither uses the operator's browser profile nor executes agent-provided scripts.

The same server offers interactive local_browser_open, local_browser_click, local_browser_fill, local_browser_press, local_browser_snapshot, and local_browser_screenshot tools for walking through a service the agent starts on this machine. That browser is limited to loopback (localhost, *.localhost, 127.0.0.0/8, ::1). Every request, WebSocket, or navigation to any other host is aborted and listed in the tool result. The agent's own sandbox can already reach these services, so the tools add a browser without adding network reach. Each lease gets one tab at a time, a fresh context per viewport, and at most 300 actions.

Install the runtime's pinned browser once on the agent host (and after a Playwright version update):

npx @sagentlab/navarch-runtime browser-install

The source installer does this automatically. Linux hosts must also have Playwright's Chromium system libraries installed. Browser-startup failures are returned as capture errors; the runtime does not relax host permissions. Docker sessions continue to use their image's tooling, and an operator-supplied NAVARCH_MCP_CONFIG_PATH remains authoritative.

User-attached MCP servers

Besides the platform MCP, a session receives the HTTP and stdio MCP servers its project or organization attached (POST /api/broker/mcp-servers; see User-attached MCP servers). The runtime merges them into the per-session MCP config for Claude Code, Codex, OpenCode, ACP and Qoder; other runtimes keep only the platform MCP. A stdio server runs on this machine (inside the Docker sandbox in Docker mode) with the session's access. The control plane drops them for review, verify and QA sessions unless the owner opted a server in. A lookup failure or an invalid server is logged and skipped; the session still starts. An operator NAVARCH_MCP_CONFIG_PATH disables them.

Browser capability probe

browser-use is advertised only after a startup launch check passes. When start boots, the runtime launches its headless Chromium on the host. Then, for every advertised runtime that wraps agent shells in an OS sandbox (currently Codex, unless it runs with --dangerously-bypass-approvals-and-sandbox or danger-full-access), it launches Chromium again through codex sandbox with the same permission policy a session gets. If either launch fails, the runtime claims without browser-use and reports the reason on every machine heartbeat; the Agents page shows it. The result is cached for the process lifetime, so restart the agent after fixing the browser to re-probe. navarch-runtime doctor runs the same check.

Codex's macOS seatbelt denies Chromium's Mach port registration (bootstrap_check_in ... MachPortRendezvousServer: Permission denied), and --single-process crashes once a second page opens. When Node runs in the sandbox and only Chromium fails, the probe still passes, with that reason. Codex sessions then browse local services through the local_browser_* tools above, and the session prompt tells them to. With an operator NAVARCH_MCP_CONFIG_PATH those tools are absent, so the machine does not take browser tasks; run those with another agent such as Claude Code, or use Docker mode. Docker mode is not probed because its image supplies the browser. Set NAVARCH_BROWSER_PROBE=off to trust the configured capability list without a check.

Call the tool with url, source_commit_sha, and evidence_role (before or after). Optional wait_for_selector and settle_ms let a scene finish loading. The URL's deployed SHA must be checked by the agent: the supplied SHA is metadata, not platform attestation. Authenticated/interactive journeys still use their existing browser tools; this capture tool starts with no cookies.

Each successful image is registered through lease-scoped register_artifact and uploaded to R2. The response contains durable URLs; the agent must inspect the images. Before session completion the runtime posts the uploaded evidence to the matching delivery PR using its scoped GitHub credential. A publication failure keeps verification blocked and preserves the uploaded artifact URLs. The capture endpoint binds only to loopback, requires a per-lease bearer, and is revoked when the lease ends. Captures are serialized and limited to ten attempts per lease. No app-repository capture script or GitHub browser upload is required.

Run the real Chromium smoke test with NAVARCH_TEST_REAL_BROWSER=1 npm test -- tests/browser-evidence.test.cts from runtime/. It renders desktop/mobile PNGs through the same HTTP MCP tool while substituting the artifact upload destination.

The machine-side half of Navarch (WP-07): registers this machine with the control plane, then loops claim → sandbox → agent CLI → report until you stop it. Plain Node/TypeScript, no Next.js coupling, and no shared app-code coupling — this directory is a self-contained package you can npx on any fresh machine.…