Bring your own subscription (local runner)

By default Navidiff runs the review passes on the server. With a local runner they run on your machine instead — on your own Claude Code or Codex subscription, exactly as if you'd run claude or codex yourself. Nothing hands your subscription credentials to the server; the server only hands the runner a job.

How it fits together

The hosted app stays the control plane — accounts, GitHub, sessions, the review UI. A small navidiff-runner process on your machine connects out to it over a WebSocket, says which providers it can run (claude, codex, or both, from your local logins), and executes the jobs the app dispatches: it clones the repo with a short-lived token, runs the pass on your subscription, and streams the results back. Verdicts appear in the browser identically to a server-side run — you just aren't paying the server's rate window, you're using your own.

Start a runner

1. In the app, open Workspace & account → Local runner and click Generate runner command. It mints a token bound to your workspace and shows a one-liner.

2. On a machine where claude (run claude once to log in) or Codex (codex login) is authenticated, run it:

   bunx @navidiff/runner --url https://app.navidiff.com --token nvr_…

   It prints its provider capabilities and registered. The panel flips to 1 runner connected.

3. Pick the provider for a review in the header's run picker (auto / claude / codex). Leave it on auto to use the runner's default.

Server modes

Set NAVIDIFF_RUNNER_MODE on the control plane:

mode	behavior
off	Always run in-process on the server (the default).
prefer	Dispatch to a connected runner for the session's org; fall back to the server if none.
require	Dispatch to a runner, or fail the run — the server never spends its own subscription.

Notes

• The runner needs git and the provider CLI on its PATH, and a writable clone cache (NAVIDIFF_REPOS_ROOT, default ~/.local/share/navidiff/repos).
• The token is bound to your org and is revocable — generate a new one to invalidate the old.
• The runner holds no database and never sees the GitHub App private key; it clones with a short-lived, single-repository installation token the control plane mints per job.
• require mode with no runner connected fails fast with a clear message rather than silently running on the server.