@algosuite/vo-mcp 0.2.0-beta.20 → 0.2.0-beta.22

package/dist/runner-cli.js

@@ -2241,6 +2241,37 @@ var init_spend_cap_shim = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/installation-token.mjs
+async function fetchInstallationToken({ req, required = false, readOnly = false, repo = null }) {
+  const fail = (reason) => {
+    if (required) throw new Error(`installation-token required: ${reason}`);
+    return null;
+  };
+  try {
+    const res = await req(
+      "POST",
+      "/api/v1/github/installation-token",
+      readOnly ? { scope: "read", ...repo ? { repo } : {} } : {},
+      readOnly ? { timeoutMs: READ_TOKEN_TIMEOUT_MS } : {}
+    );
+    if (!res.ok) return fail(`HTTP ${res.status}`);
+    const json = await res.json();
+    if (!json || !json.token) return fail("missing token");
+    if (readOnly && json.scope !== "read") return fail("control plane did not confirm a read-only grant");
+    return { token: json.token, expiresAt: json.expires_at || null };
+  } catch (err) {
+    if (required) throw err;
+    return null;
+  }
+}
+var READ_TOKEN_TIMEOUT_MS;
+var init_installation_token = __esm({
+  "../../scripts/virtual-office/code-runner/installation-token.mjs"() {
+    "use strict";
+    READ_TOKEN_TIMEOUT_MS = 15e3;
+  }
+});
+
 // src/runner/control-plane-auth-stub.mjs
 var control_plane_auth_stub_exports = {};
 __export(control_plane_auth_stub_exports, {
@@ -2477,7 +2508,7 @@ function createControlPlaneClient({
      * authenticated operator so the web shows a TRUE "runner online" signal.
      * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.
      */
-    async postHeartbeat({ runnerId, runnerInstanceId, operatorId, uptimeSec, activeTasks, maxConcurrency, effectiveConcurrency, measuredTaskSlots, measuredCpuSlots, measuredMemorySlots, version, daemonVersion, defaultAgent, supervisorInstanceId, supervisorVersion, supervisorCapabilities, servedRepos, servedOperators, availableAgents, accountUsage }) {
+    async postHeartbeat({ runnerId, runnerInstanceId, operatorId, uptimeSec, activeTasks, maxConcurrency, effectiveConcurrency, measuredTaskSlots, measuredCpuSlots, measuredMemorySlots, version, daemonVersion, defaultAgent, supervisorInstanceId, supervisorVersion, supervisorCapabilities, servedRepos, servedOperators, availableAgents, accountUsage, availableLocalModels }) {
       const body = { runner_id: runnerId };
       if (runnerInstanceId) body.runner_instance_id = runnerInstanceId;
       if (operatorId) body.operator_id = operatorId;
@@ -2506,6 +2537,9 @@ function createControlPlaneClient({
       if (Array.isArray(accountUsage) && accountUsage.length > 0) {
         body.account_usage = accountUsage;
       }
+      if (Array.isArray(availableLocalModels) && availableLocalModels.length > 0) {
+        body.available_local_models = availableLocalModels;
+      }
       const res = await req("POST", "/api/v1/runner/heartbeat", body, {
         timeoutMs: heartbeatTimeoutMs
       });
@@ -2561,37 +2595,9 @@ function createControlPlaneClient({
       const json = await res.json();
       return json?.action || null;
     },
-    /**
-     * Mint a short-lived (~1h), repo-scoped GitHub App installation token for
-     * THIS runner's operator (M3). The control-plane keys the mint on the
-     * authenticated operator (ctx.operator_id), so the token covers only that
-     * operator's installation.
-     *
-     * Returns { token, expiresAt } on success. In legacy/admin mode it returns
-     * null on a miss so the caller may use ambient `gh`. In scoped-operator mode
-     * callers pass `{ required: true }`, which fails closed instead of letting a
-     * missing/mis-scoped installation fall through to the runner machine's `gh`.
-     *
-     * The minted token is only usable for push + PR if the GitHub App grants
-     * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr
-     * create) — see docs/vo/github-app-setup-2026-06-18.md. A token missing
-     * either scope fails at push (→ ambient fallback) or at `gh pr create`.
-     */
-    async getInstallationToken({ required = false } = {}) {
-      const fail = (reason) => {
-        if (required) throw new Error(`installation-token required: ${reason}`);
-        return null;
-      };
-      try {
-        const res = await req("POST", "/api/v1/github/installation-token", {});
-        if (!res.ok) return fail(`HTTP ${res.status}`);
-        const json = await res.json();
-        if (!json || !json.token) return fail("missing token");
-        return { token: json.token, expiresAt: json.expires_at || null };
-      } catch (err) {
-        if (required) throw err;
-        return null;
-      }
+    /** Mint a GitHub App installation token — see installation-token.mjs. */
+    async getInstallationToken({ required = false, readOnly = false, repo = null } = {}) {
+      return fetchInstallationToken({ req, required, readOnly, repo });
     },
     /**
      * Read the operator's dispatch-mode config (Fast→Ultracode effort setting).
@@ -2614,6 +2620,7 @@ var cachedFirebaseToken;
 var init_control_plane_client = __esm({
   "../../scripts/virtual-office/code-runner/control-plane-client.mjs"() {
     "use strict";
+    init_installation_token();
     cachedFirebaseToken = null;
   }
 });
@@ -3752,7 +3759,10 @@ var init_agent_key_store = __esm({
       meta: ["MODEL_API_KEY"],
       // Generic OpenAI-compatible runner (bring-your-own model + endpoint): its key
       // is a dedicated var so it never collides with a real OpenAI/Codex key.
-      "oai-compat": ["VO_CODE_RUNNER_OAI_API_KEY"]
+      "oai-compat": ["VO_CODE_RUNNER_OAI_API_KEY"],
+      // Sovereign local inference (Ollama / LM Studio). The key is OPTIONAL — most
+      // local servers need none — and exists for locally secured endpoints only.
+      local: ["VO_CODE_RUNNER_LOCAL_API_KEY"]
     };
     PROVIDER_ALIAS = {
       claude: "anthropic",
@@ -3765,7 +3775,10 @@ var init_agent_key_store = __esm({
       spark: "meta",
       "muse-spark": "meta",
       oai: "oai-compat",
-      "oai-compat": "oai-compat"
+      "oai-compat": "oai-compat",
+      local: "local",
+      ollama: "local",
+      lmstudio: "local"
     };
     _loadTried2 = false;
   }
@@ -3835,6 +3848,11 @@ function itemText(item) {
   }
   return "";
 }
+function parseCodexVersion(stdout) {
+  if (typeof stdout !== "string") return null;
+  const match = stdout.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/u);
+  return match ? match[1] : null;
+}
 function parseCodexEvent(line) {
   const trimmed = String(line || "").trim();
   if (!trimmed) return null;
@@ -3929,7 +3947,7 @@ var init_codex_runner = __esm({
             ...this.getSpawnOptions({ bin }),
             windowsHide: true,
             timeout: 3e3,
-            stdio: "ignore"
+            encoding: "utf8"
           });
           if (version.error) {
             return { installed: false, authenticated: false, message: `codex not found on PATH: ${version.error.message}` };
@@ -3937,6 +3955,8 @@ var init_codex_runner = __esm({
           if (version.status !== 0) {
             return { installed: true, authenticated: false, message: "codex exists but --version failed (auth unclear)" };
           }
+          const cliVersion = parseCodexVersion(version.stdout);
+          const versionField = cliVersion ? { version: cliVersion } : {};
           const login = this.spawn(bin, ["login", "status"], {
             ...this.getSpawnOptions({ bin }),
             windowsHide: true,
@@ -3951,18 +3971,21 @@ ${login.stderr || ""}`.trim();
               return {
                 installed: true,
                 authenticated: true,
+                ...versionField,
                 message: "codex API key available (no persisted ChatGPT login)"
               };
             }
             return {
               installed: true,
               authenticated: false,
+              ...versionField,
               message: output || login.error?.message || "codex is installed but not logged in"
             };
           }
           return {
             installed: true,
             authenticated: true,
+            ...versionField,
             message: output || "codex login status succeeded"
           };
         } catch (err) {
@@ -4096,6 +4119,200 @@ var init_cursor_runner = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/local-model-runner.mjs
+function resolveLocalProvider(env2 = process.env) {
+  return String(env2.VO_CODE_RUNNER_LOCAL_PROVIDER || "").trim().toLowerCase() || DEFAULT_LOCAL_PROVIDER;
+}
+function setRemoteDesiredLocalModel(model) {
+  const value = typeof model === "string" ? model.trim() : "";
+  remoteDesiredLocalModel = value && isValidLocalModel(value) ? value : "";
+}
+function resolveLocalModel(env2 = process.env) {
+  return String(env2.VO_CODE_RUNNER_LOCAL_MODEL || "").trim() || remoteDesiredLocalModel;
+}
+function resolveLocalBaseUrl(env2 = process.env) {
+  return String(env2.VO_CODE_RUNNER_LOCAL_BASE_URL || "").trim();
+}
+function isValidLocalModel(model) {
+  return LOCAL_MODEL_RE.test(String(model || ""));
+}
+function isLoopbackBaseUrl(url) {
+  const raw = String(url || "").trim();
+  if (!/^https?:\/\/[^\s"'`\\]+$/.test(raw)) return false;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return false;
+  }
+  const host = parsed.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+function buildLocalArgs(opts = {}, env2 = process.env) {
+  const provider = resolveLocalProvider(env2);
+  if (!LOCAL_PROVIDERS.includes(provider)) {
+    throw new Error(
+      `local-model runner: unknown VO_CODE_RUNNER_LOCAL_PROVIDER "${provider}" (supported: ${LOCAL_PROVIDERS.join(", ")}).`
+    );
+  }
+  const model = resolveLocalModel(env2);
+  if (!model) {
+    throw new Error(
+      "local-model runner: set VO_CODE_RUNNER_LOCAL_MODEL to a model your local server already has (recommended: gpt-oss:20b \u2014 codex drives its tool loop reliably; generic chat models often cannot edit files agentically), or pick an already-pulled model from the web runner settings. Refusing to run with no explicit model (fail-closed)."
+    );
+  }
+  if (!isValidLocalModel(model)) {
+    throw new Error(`local-model runner: "${model}" is not a valid local model id.`);
+  }
+  const baseUrl = resolveLocalBaseUrl(env2);
+  if (baseUrl && !isLoopbackBaseUrl(baseUrl)) {
+    throw new Error(
+      "local-model runner: VO_CODE_RUNNER_LOCAL_BASE_URL must be a loopback http(s) URL (localhost / 127.0.0.1 / [::1]). Remote endpoints are refused \u2014 use the Model Firewall lanes for hosted providers."
+    );
+  }
+  const args = [
+    "exec",
+    "--json",
+    "-c",
+    'approval_policy="never"',
+    "--sandbox",
+    "workspace-write",
+    "--skip-git-repo-check",
+    "--oss",
+    "--local-provider",
+    provider,
+    "--model",
+    model
+  ];
+  if (opts.effort) {
+    args.push("-c", `model_reasoning_effort="${String(opts.effort)}"`);
+  }
+  args.push("-");
+  return args;
+}
+function applyLocalAuthEnv(baseEnv = process.env, configEnv = process.env) {
+  const out = withAgentKey("local", baseEnv);
+  const baseUrl = resolveLocalBaseUrl(configEnv);
+  if (baseUrl && isLoopbackBaseUrl(baseUrl) && resolveLocalProvider(configEnv) === "ollama" && !String(out.OLLAMA_HOST || "").trim()) {
+    out.OLLAMA_HOST = baseUrl.replace(/\/+$/, "");
+  }
+  return out;
+}
+var LOCAL_API_KEY_ENV, LOCAL_PROVIDERS, DEFAULT_LOCAL_PROVIDER, LOCAL_PROBE_URLS, remoteDesiredLocalModel, LOCAL_MODEL_RE, LocalModelRunner, localModelRunner;
+var init_local_model_runner = __esm({
+  "../../scripts/virtual-office/code-runner/local-model-runner.mjs"() {
+    "use strict";
+    init_codex_runner();
+    init_agent_key_store();
+    LOCAL_API_KEY_ENV = "VO_CODE_RUNNER_LOCAL_API_KEY";
+    LOCAL_PROVIDERS = ["ollama", "lmstudio"];
+    DEFAULT_LOCAL_PROVIDER = "ollama";
+    LOCAL_PROBE_URLS = {
+      ollama: "http://127.0.0.1:11434/api/version",
+      lmstudio: "http://127.0.0.1:1234/v1/models"
+    };
+    remoteDesiredLocalModel = "";
+    LOCAL_MODEL_RE = new RegExp("^[A-Za-z0-9][A-Za-z0-9._/:-]{0,127}$");
+    LocalModelRunner = class {
+      constructor({
+        spawn: spawn5 = null,
+        resolveBinary = resolveCodexBinary,
+        env: env2 = process.env,
+        fetchImpl = globalThis.fetch
+      } = {}) {
+        this.spawn = spawn5;
+        this.resolveBinary = resolveBinary;
+        this.env = env2;
+        this.fetchImpl = fetchImpl;
+      }
+      /** Codex is the transport binary; the model/endpoint are the user's. */
+      get binary() {
+        return this.resolveBinary();
+      }
+      buildArgs(opts = {}) {
+        return buildLocalArgs(opts, this.env);
+      }
+      /** Codex JSONL events map identically → reuse the proven parser. */
+      parseEvent(line) {
+        return parseCodexEvent(line);
+      }
+      // SECURITY: never shell — see no-shell-spawn.test.mjs. The model id is
+      // control-plane-influenced and validated, but shell:false is the hard floor.
+      getSpawnOptions() {
+        return {
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
+        };
+      }
+      applyAuthEnv(env2 = process.env) {
+        return applyLocalAuthEnv(env2, this.env);
+      }
+      describeAuth(env2 = process.env) {
+        const authEnv = this.applyAuthEnv(env2);
+        const provider = resolveLocalProvider(this.env);
+        const model = resolveLocalModel(this.env) || "<unset>";
+        const hasKey = Boolean(String(authEnv[LOCAL_API_KEY_ENV] || "").trim());
+        return `local provider=${provider} model=${model} key=${hasKey ? "set" : "none (optional)"}`;
+      }
+      /**
+       * Best-effort: codex transport present AND the local inference endpoint
+       * answers. Never throws, never spends tokens; the endpoint probe is bounded
+       * to 1.5s so a stopped Ollama can't hang availability checks.
+       */
+      async checkAuth() {
+        const provider = resolveLocalProvider(this.env);
+        if (!LOCAL_PROVIDERS.includes(provider)) {
+          return {
+            installed: false,
+            authenticated: false,
+            message: `unknown local provider "${provider}" (supported: ${LOCAL_PROVIDERS.join(", ")})`
+          };
+        }
+        const model = resolveLocalModel(this.env);
+        const override = resolveLocalBaseUrl(this.env);
+        if (override && !isLoopbackBaseUrl(override)) {
+          return {
+            installed: true,
+            authenticated: false,
+            message: "VO_CODE_RUNNER_LOCAL_BASE_URL is not loopback \u2014 refused (fail-closed)"
+          };
+        }
+        const probeUrl = provider === "ollama" && override ? `${override.replace(/\/+$/, "")}/api/version` : LOCAL_PROBE_URLS[provider];
+        let endpointUp = false;
+        let probeNote = "";
+        try {
+          const res = await this.fetchImpl(probeUrl, { signal: AbortSignal.timeout(1500) });
+          endpointUp = Boolean(res?.ok);
+          if (!endpointUp) probeNote = `endpoint ${probeUrl} answered HTTP ${res?.status}`;
+        } catch {
+          probeNote = `no local inference server answering at ${probeUrl}`;
+        }
+        if (!endpointUp) {
+          return {
+            installed: true,
+            authenticated: false,
+            message: `${probeNote} \u2014 start ${provider === "ollama" ? "Ollama" : "LM Studio"} first`
+          };
+        }
+        if (!model) {
+          return {
+            installed: true,
+            authenticated: false,
+            message: `${provider} is running but VO_CODE_RUNNER_LOCAL_MODEL is not set`
+          };
+        }
+        return {
+          installed: true,
+          authenticated: true,
+          message: `${provider} reachable; model "${model}" configured (local-only, no cloud spend)`
+        };
+      }
+    };
+    localModelRunner = new LocalModelRunner();
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/meta-runner.mjs
 function applyMetaAuthEnv(baseEnv = process.env) {
   const out = withAgentKey("meta", baseEnv);
@@ -4311,6 +4528,7 @@ var init_resolve_runner = __esm({
     init_claude_runner();
     init_codex_runner();
     init_cursor_runner();
+    init_local_model_runner();
     init_meta_runner();
     init_openai_compatible_runner();
     init_agent_runner_interface();
@@ -4319,6 +4537,9 @@ var init_resolve_runner = __esm({
       claude: claudeRunner,
       codex: codexRunner,
       cursor: cursorRunner,
+      // `local` = sovereign local inference (Ollama / LM Studio; Mistral/Llama-class
+      // models) — free tier of the pricing pivot; nothing leaves the user's machine.
+      local: localModelRunner,
       meta: metaRunner,
       oai: openaiCompatibleRunner
     };
@@ -5983,6 +6204,12 @@ function makeLoopTicks({
     applyCapacity: () => false,
     heartbeatFields: () => ({})
   },
+  // Track 1: served-local-model reporting + desired-model echo application
+  // (local-model-remote-config.mjs). No-op defaults keep old callers working.
+  localModelController = {
+    applyRemoteConfig: () => false,
+    heartbeatFields: () => ({})
+  },
   // Cached agent-availability provider (agent-availability.mjs); returns null
   // until the first probe completes — the heartbeat simply omits the field.
   getAgentAvailability = () => null,
@@ -6020,7 +6247,10 @@ function makeLoopTicks({
         } catch (error) {
           request = Promise.reject(error);
         }
-        request.then((response) => capacityController.applyCapacity(response?.capacity, nextPayload.operatorId)).catch((e) => log3(`heartbeat failed: ${e.message}`)).finally(() => {
+        request.then((response) => {
+          capacityController.applyCapacity(response?.capacity, nextPayload.operatorId);
+          localModelController.applyRemoteConfig(response?.local_model, nextPayload.operatorId);
+        }).catch((e) => log3(`heartbeat failed: ${e.message}`)).finally(() => {
           for (const done of waiters) done();
           if (state.pending) {
             const pending = state.pending;
@@ -6062,6 +6292,7 @@ function makeLoopTicks({
       const supervisorVersion = String(env2.VO_RUNNER_SUPERVISOR_VERSION || "").trim().slice(0, 40);
       const supervisorCapabilities = String(env2.VO_RUNNER_SUPERVISOR_CAPABILITIES || "").split(",").map((value) => value.trim()).filter(Boolean).slice(0, 8);
       const capacityFields = capacityController.heartbeatFields();
+      const localModelFields = localModelController.heartbeatFields();
       const baseHeartbeat = {
         runnerId: cfg.runnerId,
         ...runnerInstanceId ? { runnerInstanceId } : {},
@@ -6078,7 +6309,8 @@ function makeLoopTicks({
         uptimeSec: Math.floor(process.uptime()),
         activeTasks: getActive(),
         maxConcurrency: cfg.maxConcurrency,
-        ...capacityFields
+        ...capacityFields,
+        ...localModelFields
       };
       const operatorIds = servedOperators.length > 0 ? servedOperators : [void 0];
       for (const operatorId of operatorIds) {
@@ -6204,7 +6436,12 @@ async function collectAgentAvailability({
   const probes = agents.map(async (agent) => {
     try {
       const r = await runnerFor(agent).checkAuth();
-      return { agent, installed: Boolean(r?.installed), authenticated: Boolean(r?.authenticated) };
+      return {
+        agent,
+        installed: Boolean(r?.installed),
+        authenticated: Boolean(r?.authenticated),
+        ...typeof r?.version === "string" && r.version ? { version: r.version } : {}
+      };
     } catch {
       return { agent, installed: false, authenticated: false };
     }
@@ -6245,6 +6482,127 @@ var init_agent_availability = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/local-model-remote-config.mjs
+async function listServedLocalModels({
+  env: env2 = process.env,
+  fetchImpl = globalThis.fetch,
+  timeoutMs = 1500
+} = {}) {
+  const provider = resolveLocalProvider(env2);
+  if (!LOCAL_PROVIDERS.includes(provider)) return null;
+  const override = resolveLocalBaseUrl(env2);
+  if (override && !isLoopbackBaseUrl(override)) return null;
+  const url = provider === "ollama" && override ? `${override.replace(/\/+$/, "")}/api/tags` : SERVED_MODELS_PROBE_URLS[provider];
+  try {
+    const res = await fetchImpl(url, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!res?.ok) return null;
+    const json = await res.json();
+    const names = provider === "ollama" ? Array.isArray(json?.models) ? json.models.map((m) => m?.name) : null : Array.isArray(json?.data) ? json.data.map((m) => m?.id) : null;
+    if (!names) return null;
+    return names.filter((name) => typeof name === "string" && isValidLocalModel(name)).slice(0, MAX_REPORTED_MODELS);
+  } catch {
+    return null;
+  }
+}
+function createLocalModelRemoteController({
+  env: env2 = process.env,
+  fetchImpl = globalThis.fetch,
+  log: log3 = () => {
+  },
+  probeIntervalMs = 6e4,
+  now = () => Date.now(),
+  apply = setRemoteDesiredLocalModel,
+  listModels = listServedLocalModels
+} = {}) {
+  let served = null;
+  const byOperator = /* @__PURE__ */ new Map();
+  let probing = false;
+  let lastProbeAt = 0;
+  let warnedUnserved = "";
+  let warnedConflict = "";
+  function desiredModel() {
+    const models = [...new Set(
+      [...byOperator.values()].map((s) => s.desired).filter((m) => typeof m === "string" && m)
+    )];
+    if (models.length > 1) {
+      const key = models.slice().sort().join(",");
+      if (warnedConflict !== key) {
+        warnedConflict = key;
+        log3(`local-model remote config: conflicting desired models across served operators (${key}) \u2014 applying none`);
+      }
+      return null;
+    }
+    return models[0] ?? null;
+  }
+  function syncEffective() {
+    const desired = desiredModel();
+    const effective = desired && Array.isArray(served) && served.includes(desired) ? desired : "";
+    apply(effective);
+    if (desired && !effective && warnedUnserved !== desired) {
+      warnedUnserved = desired;
+      log3(
+        `local-model remote config: "${desired}" is not served by the local inference server \u2014 ignored (never auto-pull; pull it locally first)`
+      );
+    }
+    return effective;
+  }
+  function refreshServedModels() {
+    if (probing || now() - lastProbeAt < probeIntervalMs) return;
+    probing = true;
+    lastProbeAt = now();
+    Promise.resolve(listModels({ env: env2, fetchImpl })).then((models) => {
+      if (Array.isArray(models)) served = models;
+      syncEffective();
+    }).catch(() => {
+    }).finally(() => {
+      probing = false;
+    });
+  }
+  return {
+    /** Heartbeat payload extras; also kicks the throttled background probe. */
+    heartbeatFields() {
+      refreshServedModels();
+      return Array.isArray(served) && served.length > 0 ? { availableLocalModels: served } : {};
+    },
+    /**
+     * Apply one operator's heartbeat-response echo
+     * { schema_version, desired_local_model, revision }. Revision ordering is
+     * PER OPERATOR — counters are independent across operator scopes.
+     */
+    applyRemoteConfig(echo, operatorId = "") {
+      const scope = String(operatorId || "");
+      const previous = byOperator.get(scope);
+      if (!echo || echo.schema_version !== 1 || !Number.isInteger(echo.revision) || previous && echo.revision < previous.revision) {
+        return false;
+      }
+      const model = echo.desired_local_model;
+      if (model !== null && (typeof model !== "string" || !isValidLocalModel(model))) {
+        return false;
+      }
+      byOperator.set(scope, { revision: echo.revision, desired: model });
+      syncEffective();
+      return true;
+    },
+    snapshot: () => ({
+      served,
+      desired: desiredModel(),
+      operators: Object.fromEntries(byOperator)
+    })
+  };
+}
+var SERVED_MODELS_PROBE_URLS, MAX_REPORTED_MODELS;
+var init_local_model_remote_config = __esm({
+  "../../scripts/virtual-office/code-runner/local-model-remote-config.mjs"() {
+    "use strict";
+    init_local_model_runner();
+    SERVED_MODELS_PROBE_URLS = {
+      ollama: "http://127.0.0.1:11434/api/tags",
+      lmstudio: "http://127.0.0.1:1234/v1/models"
+    };
+    MAX_REPORTED_MODELS = 50;
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/account-usage.mjs
 import { spawn as spawn4 } from "node:child_process";
 import fs6 from "node:fs";
@@ -6854,7 +7212,8 @@ function makeWatchRunner({
   maxFixAttempts,
   repairEvidence = readCiRepairEvidence,
   stateFile = DEFAULT_STATE_FILE,
-  autoMergeEnabled = process.env.VO_CODE_RUNNER_ARM_AUTOMERGE === "1"
+  // Default ON (operator directive 2026-07-24); VO_CODE_RUNNER_ARM_AUTOMERGE=0 opts out.
+  autoMergeEnabled = process.env.VO_CODE_RUNNER_ARM_AUTOMERGE !== "0"
 }) {
   return () => runWatchCycle({
     viewPr,
@@ -7511,7 +7870,7 @@ var init_model_router = __esm({
     "use strict";
     init_model_registry();
     init_meta_model_catalog();
-    TASK_MODEL_AGENTS = ["claude", "codex", "cursor", "meta"];
+    TASK_MODEL_AGENTS = ["claude", "codex", "cursor", "local", "meta"];
     DEFAULT_AGENT2 = "claude";
     AGENT_TIER_FAMILIES = {
       claude: {
@@ -7533,6 +7892,13 @@ var init_model_router = __esm({
         mid: null,
         best: null
       },
+      // Local models are machine-specific pulls (Ollama / LM Studio); the runner's
+      // VO_CODE_RUNNER_LOCAL_MODEL is the source of truth, not the registry.
+      local: {
+        cheap: null,
+        mid: null,
+        best: null
+      },
       meta: {
         cheap: null,
         mid: null,
@@ -7555,6 +7921,11 @@ var init_model_router = __esm({
         mid: null,
         best: null
       },
+      local: {
+        cheap: null,
+        mid: null,
+        best: null
+      },
       meta: {
         cheap: resolveMetaModelForTier("cheap"),
         mid: resolveMetaModelForTier("mid"),
@@ -7573,6 +7944,16 @@ var init_model_router = __esm({
       // cursor-runner. Restrict to the shape a model id actually has so a payload
       // like `x & powershell -enc ...` is rejected before it reaches a spawn.
       cursor: (model) => /^[A-Za-z0-9][A-Za-z0-9._:@\[\]-]{0,79}$/.test(String(model || "")),
+      // SECURITY: the local lane accepts NO remote model pins — return false for
+      // EVERY value so control-plane `task.model` can never influence what runs on
+      // the user's machine. codex `--oss` AUTO-PULLS missing models (live-verified
+      // 2026-07-24: a single --model argument downloaded 397MB unprompted), so an
+      // honored pin like "llama3.1:405b" (231GB, valid id shape) would let any
+      // tenant member remotely fill a BYO runner owner's disk. The machine-local
+      // env (VO_CODE_RUNNER_LOCAL_MODEL — the owner's own choice in the app) is
+      // the ONLY model authority, mirroring the runner-release-target principle
+      // that browser input is never local-execution authority.
+      local: () => false,
       meta: (model) => /^muse-spark-[A-Za-z0-9._:@\[\]-]{0,79}$/i.test(String(model || ""))
     };
   }
@@ -8461,11 +8842,41 @@ var init_reconnect_backoff = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/redact-tokens.mjs
+function redactSecrets(text) {
+  if (typeof text !== "string" || text.length === 0) return text;
+  let out = text;
+  for (const [re, mask] of TOKEN_PATTERNS) out = out.replace(re, mask);
+  return out;
+}
+function redactPatch(patch) {
+  if (!patch || typeof patch !== "object") return patch;
+  const out = Array.isArray(patch) ? [...patch] : { ...patch };
+  for (const [k, v] of Object.entries(out)) {
+    if (typeof v === "string") out[k] = redactSecrets(v);
+    else if (v && typeof v === "object") out[k] = redactPatch(v);
+  }
+  return out;
+}
+var TOKEN_PATTERNS;
+var init_redact_tokens = __esm({
+  "../../scripts/virtual-office/code-runner/redact-tokens.mjs"() {
+    "use strict";
+    TOKEN_PATTERNS = [
+      [/\b(?:gh[oprsu]|vocred|npm)_[A-Za-z0-9._-]{10,}\b/gu, "[REDACTED]"],
+      [/\bgithub_pat_[A-Za-z0-9_]{10,}\b/gu, "[REDACTED]"],
+      // Keep the scheme so the line still reads as an auth header, matching
+      // sanitizeMaintenanceDiagnostic's behaviour.
+      [/\bBearer\s+[A-Za-z0-9._~+/-]{10,}=*/giu, "Bearer [REDACTED]"]
+    ];
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/task-helpers.mjs
 function makeSafeProgress(log3) {
   return async (client, id, patch) => {
     try {
-      const r = await client.postProgress(id, patch);
+      const r = await client.postProgress(id, redactPatch(patch));
       if (r && r.terminal) log3(`task ${id} is terminal server-side; stopping updates`);
       return r;
     } catch (err) {
@@ -8491,20 +8902,34 @@ function buildPrBody(task, run, files, { armAutoMerge = false } = {}) {
     "### Prompt",
     "",
     "```",
-    String(task.prompt).slice(0, 2e3),
+    redactSecrets(String(task.prompt)).slice(0, 2e3),
     "```",
     "",
     "### Agent summary",
     "",
-    String(run.summary || "").slice(0, 2e3),
+    redactSecrets(String(run.summary || "")).slice(0, 2e3),
     "",
     "---",
     armAutoMerge ? "_Opened by the AlgoHQ code-runner daemon. After CI passes, the watcher must obtain a durable consensus receipt and merge the exact verified SHA._" : "_Opened by the AlgoHQ code-runner daemon. This PR awaits the verify-before-act gate / operator review \u2014 it is NOT auto-merged._"
   ].filter((l) => l !== "").join("\n");
 }
+async function mintRunnerGithubTokens({ client, taskId, log: log3, repo = null, requirePublish = false }) {
+  const publishToken = (await client.getInstallationToken({ required: requirePublish }))?.token ?? null;
+  let agentReadToken = null;
+  let reason = null;
+  try {
+    agentReadToken = (await client.getInstallationToken({ readOnly: true, repo }))?.token ?? null;
+    if (!agentReadToken) reason = "control plane returned no confirmed read-only grant";
+  } catch (err) {
+    reason = err?.message ?? String(err);
+  }
+  if (!agentReadToken) log3(`task ${taskId}: no GitHub read access for the agent (${reason}); it cannot read a private repo`);
+  return { publishToken, agentReadToken };
+}
 var init_task_helpers = __esm({
   "../../scripts/virtual-office/code-runner/task-helpers.mjs"() {
     "use strict";
+    init_redact_tokens();
   }
 });
 
@@ -8520,8 +8945,12 @@ function safeBaseEnv(env2 = {}) {
   }
   return result;
 }
-function buildAgentProcessEnv(env2, { agent = "agent", runnerId = "vo-runner", taskId = "task" } = {}) {
+function buildAgentProcessEnv(env2, { agent = "agent", runnerId = "vo-runner", taskId = "task", githubReadToken = null } = {}) {
   const base = safeBaseEnv(env2);
+  if (typeof githubReadToken === "string" && githubReadToken) {
+    base.GH_TOKEN = githubReadToken;
+    base.GITHUB_TOKEN = githubReadToken;
+  }
   if (String(env2?.AGENT_ID || "").trim()) return { ...base, AGENT_ID: env2.AGENT_ID };
   const generated = [
     "vo",
@@ -8569,6 +8998,198 @@ var init_agent_process_env = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/inference-executor.mjs
+function buildChatBody({ messages, prompt, model, maxTokens, temperature } = {}) {
+  const msgs = Array.isArray(messages) && messages.length > 0 ? messages : [{ role: "user", content: String(prompt ?? "") }];
+  if (msgs.length > MAX_INFERENCE_MESSAGES) {
+    throw new Error(`inference: too many messages (${msgs.length} > ${MAX_INFERENCE_MESSAGES})`);
+  }
+  const totalChars = msgs.reduce((n, m) => n + String(m?.content ?? "").length, 0);
+  if (totalChars > MAX_INFERENCE_PROMPT_CHARS) {
+    throw new Error(`inference: prompt too large (${totalChars} > ${MAX_INFERENCE_PROMPT_CHARS} chars)`);
+  }
+  if (!model || typeof model !== "string") {
+    throw new Error("inference: a model id is required");
+  }
+  const body = {
+    model,
+    messages: msgs.map((m) => ({ role: String(m.role || "user"), content: String(m.content ?? "") })),
+    stream: false,
+    max_tokens: Number.isInteger(maxTokens) && maxTokens > 0 ? maxTokens : DEFAULT_MAX_OUTPUT_TOKENS
+  };
+  if (Number.isFinite(temperature)) body.temperature = temperature;
+  return body;
+}
+function resolveInferenceEndpoint({ providerMode, baseUrl } = {}) {
+  const mode = String(providerMode || "local").toLowerCase();
+  if (mode !== "local") {
+    throw new Error(`inference: unsupported provider mode "${mode}" (this slice is local-only)`);
+  }
+  const url = String(baseUrl || DEFAULT_LOCAL_INFERENCE_BASE_URL).replace(/\/+$/, "");
+  if (!isLoopbackBaseUrl(url)) {
+    throw new Error(`inference: local base_url must be loopback (localhost/127.0.0.1/[::1]); got "${url}"`);
+  }
+  return url;
+}
+function extractCompletion(json) {
+  const choice = json?.choices?.[0];
+  const text = choice?.message?.content ?? choice?.text ?? "";
+  if (typeof text !== "string" || text.length === 0) {
+    throw new Error("inference: provider returned no completion text");
+  }
+  const usage = json?.usage ?? null;
+  return {
+    text,
+    usage: usage ? {
+      input_tokens: Number(usage.prompt_tokens) || 0,
+      output_tokens: Number(usage.completion_tokens) || 0,
+      total_tokens: Number(usage.total_tokens) || 0
+    } : null,
+    finish_reason: choice?.finish_reason ?? null
+  };
+}
+async function runInference({ providerMode = "local", baseUrl, model, prompt, messages, maxTokens, temperature, timeoutMs = 12e4 } = {}, { fetchImpl = globalThis.fetch } = {}) {
+  const endpoint = resolveInferenceEndpoint({ providerMode, baseUrl });
+  const body = buildChatBody({ messages, prompt, model, maxTokens, temperature });
+  const res = await fetchImpl(`${endpoint}/chat/completions`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (!res?.ok) {
+    const status = res?.status ?? "ERR";
+    let detail = "";
+    try {
+      detail = (await res.text()).slice(0, 300);
+    } catch {
+    }
+    throw new Error(`inference: endpoint returned HTTP ${status}${detail ? ` \u2014 ${detail}` : ""}`);
+  }
+  const json = await res.json();
+  const { text, usage, finish_reason } = extractCompletion(json);
+  return { text, usage, finish_reason, model, endpoint };
+}
+var DEFAULT_LOCAL_INFERENCE_BASE_URL, MAX_INFERENCE_MESSAGES, MAX_INFERENCE_PROMPT_CHARS, DEFAULT_MAX_OUTPUT_TOKENS;
+var init_inference_executor = __esm({
+  "../../scripts/virtual-office/code-runner/inference-executor.mjs"() {
+    "use strict";
+    init_local_model_runner();
+    DEFAULT_LOCAL_INFERENCE_BASE_URL = "http://127.0.0.1:11434/v1";
+    MAX_INFERENCE_MESSAGES = 200;
+    MAX_INFERENCE_PROMPT_CHARS = 1e5;
+    DEFAULT_MAX_OUTPUT_TOKENS = 1024;
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/inference-task-handler.mjs
+async function handleInferenceTask(task, { runInferenceImpl = runInference, now = () => Date.now() } = {}) {
+  const started = now();
+  try {
+    const result = await runInferenceImpl({
+      providerMode: "local",
+      baseUrl: task.base_url,
+      model: task.model,
+      prompt: task.prompt,
+      messages: task.messages,
+      maxTokens: task.max_output_tokens,
+      temperature: task.temperature
+    });
+    const text = String(result.text || "").slice(0, MAX_RESULT_CHARS);
+    return {
+      ok: true,
+      text,
+      usage: result.usage ?? null,
+      finish_reason: result.finish_reason ?? null,
+      provider_mode: "local",
+      // Structural $0: no AlgoSuite provider call happened, so nothing to charge.
+      billable: false,
+      duration_ms: now() - started
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      provider_mode: "local",
+      error: err instanceof Error ? err.message : String(err),
+      duration_ms: now() - started
+    };
+  }
+}
+var MAX_RESULT_CHARS;
+var init_inference_task_handler = __esm({
+  "../../scripts/virtual-office/code-runner/inference-task-handler.mjs"() {
+    "use strict";
+    init_inference_executor();
+    MAX_RESULT_CHARS = 1e5;
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/inference-task-runner.mjs
+async function processInferenceTask(client, task, cfg, {
+  env: env2 = process.env,
+  safeProgress: safeProgress2,
+  runnerStagePatch: runnerStagePatch2,
+  handle = handleInferenceTask,
+  log: log3 = () => {
+  }
+} = {}) {
+  const id = task.code_task_id;
+  await safeProgress2(
+    client,
+    id,
+    runnerStagePatch2("starting_agent", `${cfg.runnerId} running local inference for this task`, {
+      status: "running"
+    })
+  );
+  const model = resolveLocalModel(env2);
+  if (!model) {
+    await safeProgress2(client, id, {
+      status: "failed",
+      message: "inference: this runner has no local model configured",
+      result: "This computer is not configured with a local model. Set VO_CODE_RUNNER_LOCAL_MODEL (a model your Ollama / LM Studio already has), then retry."
+    });
+    return;
+  }
+  const out = await handle(
+    {
+      provider_mode: "local",
+      model,
+      prompt: task.prompt,
+      base_url: resolveLocalBaseUrl(env2) || void 0
+    },
+    { now: () => Date.now() }
+  );
+  if (out.ok) {
+    log3(`inference task ${id} completed on ${model} (${out.usage?.output_tokens ?? "?"} output tokens)`);
+    await safeProgress2(client, id, {
+      status: INFERENCE_SUCCESS_STATUS,
+      message: "inference complete",
+      result: out.text,
+      // $0 by construction — the completion was produced on the user's machine,
+      // AlgoSuite made no provider call, so there is nothing to bill.
+      cost_usd: 0,
+      num_turns: 1
+    });
+    return;
+  }
+  log3(`inference task ${id} failed: ${out.error}`);
+  await safeProgress2(client, id, {
+    status: "failed",
+    message: "inference failed",
+    result: out.error,
+    cost_usd: 0
+  });
+}
+var INFERENCE_SUCCESS_STATUS;
+var init_inference_task_runner = __esm({
+  "../../scripts/virtual-office/code-runner/inference-task-runner.mjs"() {
+    "use strict";
+    init_local_model_runner();
+    init_inference_task_handler();
+    INFERENCE_SUCCESS_STATUS = "no_changes_needed";
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
 import fs8 from "node:fs";
 import fsp9 from "node:fs/promises";
@@ -9001,7 +9622,8 @@ function loadConfig(env2 = process.env) {
     watchEnabled: env2.VO_CODE_RUNNER_WATCH !== "0",
     watchMaxFix: Math.max(0, Number(env2.VO_CODE_RUNNER_WATCH_MAX_FIX ?? 1) || 0),
     watchIntervalSec: Math.max(30, Number(env2.VO_CODE_RUNNER_WATCH_SEC ?? 60) || 60),
-    armAutoMerge: env2.VO_CODE_RUNNER_ARM_AUTOMERGE === "1",
+    armAutoMerge: env2.VO_CODE_RUNNER_ARM_AUTOMERGE !== "0",
+    // default ON (operator directive 2026-07-24); =0 opts out; receipt-gated consensus merge stays the mechanism
     // In-product runner control. Off: VO_CODE_RUNNER_CONTROL=0.
     controlEnabled: env2.VO_CODE_RUNNER_CONTROL !== "0",
     controlPort: Math.max(1, Number(env2.VO_CODE_RUNNER_CONTROL_PORT ?? 7787) || 7787),
@@ -9019,7 +9641,7 @@ async function processOneTask(client, task, cfg) {
     const wt = await Promise.resolve(createFixWorktree("code-task", { source: id.slice(0, 8), repo: task.repo }));
     worktreeName = wt.worktreeName;
     if (!worktreeName || !wt.worktreeDir) throw new Error("worktree isolation failure \u2014 refusing to run in the main tree");
-    const githubToken = (await client.getInstallationToken({ required: cfg.requireGithubAppAuth }))?.token ?? null;
+    const { publishToken: githubToken, agentReadToken: agentGithubReadToken } = await mintRunnerGithubTokens({ client, taskId: id, log: log2, repo: task.repo, requirePublish: cfg.requireGithubAppAuth });
     const parentTask = task.resumed_from ? await client.getTask(task.resumed_from).catch(() => null) : null;
     const continuationRestore = await prepareContinuationBranch(wt.worktreeDir, {
       task,
@@ -9054,7 +9676,7 @@ async function processOneTask(client, task, cfg) {
       model,
       effort: effectiveEffort,
       maxBudgetUsd: effectiveMaxBudgetUsd,
-      env: buildAgentProcessEnv(process.env, { agent: cfg.agent, runnerId: cfg.runnerId, taskId: id }),
+      env: buildAgentProcessEnv(process.env, { agent: cfg.agent, runnerId: cfg.runnerId, taskId: id, githubReadToken: agentGithubReadToken }),
       onProgress: (text) => {
         void safeProgress(client, id, runnerStagePatch("agent_working", text));
       },
@@ -9231,7 +9853,7 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
   );
   for (const line of describeClaimScoping(cfg, env2)) log2(line);
   log2(
-    cfg.armAutoMerge ? "PR auto-merge arming ON for complete PRs (VO_CODE_RUNNER_ARM_AUTOMERGE=1)" : "PR auto-merge arming OFF (set VO_CODE_RUNNER_ARM_AUTOMERGE=1 for internal dogfood autonomy)"
+    cfg.armAutoMerge ? "PR auto-merge arming ON for complete PRs (default; VO_CODE_RUNNER_ARM_AUTOMERGE=0 to disable)" : "PR auto-merge arming OFF (VO_CODE_RUNNER_ARM_AUTOMERGE=0)"
   );
   log2(
     watchCyclesEnabled ? `PR watcher ON \u2014 auto-fix ${cfg.watchMaxFix}/PR; ${cfg.armAutoMerge ? "receipt-gated merge enabled" : "merge disabled"}; every ${cfg.watchIntervalSec}s (VO_CODE_RUNNER_WATCH=0 to disable)` : once2 ? "PR watcher bypassed for --once; dispatched PRs remain tracked" : "PR watcher OFF (VO_CODE_RUNNER_WATCH=0)"
@@ -9240,7 +9862,7 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
   const watchCoordinator = makeWatchCycleCoordinator({ runWatch, log: log2, intervalMs: cfg.watchIntervalSec * 1e3 });
   const agentAvailability = makeAgentAvailabilityProvider({ onError: (e) => log2(`agent probe failed: ${e.message}`) });
   const accountUsage = makeAccountUsageProvider();
-  const loopTick = makeLoopTicks({ client, cfg, env: env2, log: log2, getActive: () => active, runnerInstanceId, capacityController, getAgentAvailability: () => agentAvailability.get(), getAccountUsage: () => accountUsage.get() });
+  const loopTick = makeLoopTicks({ client, cfg, env: env2, log: log2, getActive: () => active, runnerInstanceId, capacityController, localModelController: createLocalModelRemoteController({ env: env2, log: log2 }), getAgentAvailability: () => agentAvailability.get(), getAccountUsage: () => accountUsage.get() });
   const backoff = makeReconnectBackoff({ baseMs: cfg.pollSec * 1e3, log: log2 });
   while (!stopping) {
     const heartbeatCompletion = loopTick();
@@ -9283,7 +9905,8 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
     }
     log2(`claimed task ${task.code_task_id} (${task.repo})`);
     active += 1;
-    const done = processOneTask(client, task, cfg).finally(() => {
+    const runTask = task.kind === "inference" ? processInferenceTask(client, task, cfg, { safeProgress, runnerStagePatch, log: log2 }) : processOneTask(client, task, cfg);
+    const done = runTask.finally(() => {
       active -= 1;
     });
     if (once2) {
@@ -9316,6 +9939,7 @@ var init_code_runner_daemon = __esm({
     init_loop_ticks();
     init_runner_capacity();
     init_agent_availability();
+    init_local_model_remote_config();
     init_account_usage();
     init_pr_watcher();
     init_existing_pr_target();
@@ -9326,6 +9950,7 @@ var init_code_runner_daemon = __esm({
     init_reconnect_backoff();
     init_task_helpers();
     init_agent_process_env();
+    init_inference_task_runner();
     init_isolation_audit();
     init_recovery_ledger();
     init_no_changes_terminal_status();