@pulsehub/runner 0.1.5 → 0.1.7

package/README.md

@@ -16,7 +16,7 @@ The Runner only uses local Git and provider sessions, creates disposable worktre
 
 ## QA review jobs
 
-An agent can use a dedicated Runner identity for QA. To run more than one agent on the same machine, give each instance its own `PULSE_RUNNER_HOME`; initialize each QA instance with `--agent-role qa`, and pair each one with its own agent and Runner credential, then run `pulse-runner start` with that same environment variable. Register the QA Runner in Pulse Settings using its generated signing public key, connect every repository that has a PR in the review, pair its one-time device credential, and select it on the QA agent. Review jobs call `pulse_next_review` and `pulse_get_review_context` through Pulse MCP, inspect every PR, and submit their verdict with `pulse_submit_review`. They do not publish source changes or create PRs.
+An agent can use a dedicated Runner identity for QA. To run more than one agent on the same machine, give each instance its own `PULSE_RUNNER_HOME`; initialize each QA instance with `--agent-role qa`, and pair each one with its own agent and Runner credential, then run `pulse-runner start` with that same environment variable. Register the QA Runner in Pulse Settings using its generated signing public key, enable every repository that has a PR in the issue project, pair its one-time device credential, and select it on the QA agent. Review jobs call `pulse_next_review` and `pulse_get_review_context` through Pulse MCP, inspect every PR, and submit their verdict with `pulse_submit_review`. They do not publish source changes or create PRs.
 
 ## Preparation and preflight (TES-304)
 
@@ -43,7 +43,7 @@ Authentication command references: [Codex CLI](https://developers.openai.com/cod
 
 ## Installation and background services (TES-286)
 
-Install Node 20+, Git, the GitHub CLI and the provider CLI on macOS, Linux or Windows. Sign in locally with `gh auth login` and the provider's login command. No GitHub token needs to be entered in Pulse. Initialize with the public signing key shipped in this package, register the generated public key and approved repositories in Settings → Agentes → Pulse Runners, then pair the one-time device credential on that machine. A signing **public** key is safe to install locally; never copy the backend's signing private key.
+Install Node 20+, Git, the GitHub CLI and the provider CLI on macOS, Linux or Windows. Sign in locally with `gh auth login` and the provider's login command. No GitHub token needs to be entered in Pulse. Initialize with the public signing key shipped in this package, register the generated public key in Settings → Agentes → Pulse Runners and enable repositories in the issue project, then pair the one-time device credential on that machine. A signing **public** key is safe to install locally; never copy the backend's signing private key.
 
 Run `pulse-runner diagnose`, then use `pulse-runner run --once` for one job or `pulse-runner start` for foreground operation. `service install` registers a LaunchAgent on macOS, a systemd user unit on Linux, or an on-logon Scheduled Task on Windows. `service start|stop|status|uninstall` manages that installation. Run these commands as the same OS user who owns the local provider and Git sessions. Linux background execution requires a working user systemd session; macOS requires a logged-in GUI user; the Windows task starts on user logon.
 
@@ -57,16 +57,51 @@ While executing, the Runner sends an outbound heartbeat every two seconds with i
 
 Ctrl+C or SIGTERM also cancels foreground work. A force-killed daemon recovers on its next start: its local journal stores only the job ID, cleans interrupted worktrees/MCP files, prunes Git registrations and reports the interrupted job canceled. Committed branches remain in the local mirror; uncommitted disposable worktree edits are removed. The source checkout remains untouched. On Windows, forcibly ending the daemon may defer cleanup until that restart.
 
-The local `repo` command can retain or reduce the repository list approved during pairing; the device credential cannot widen it. To approve a larger scope, the owner/admin registers a replacement Runner with the new repository list in Pulse, revokes the old Runner and pairs the replacement locally. A rejected local change leaves the local configuration unchanged.
+Repository authorization comes from the issue project's enabled repositories, intersected with the workspace GitHub installation. Pairing and agent binding do not require a repository list. `repo add/remove` is deprecated for new jobs; configure repositories in Pulse's project settings. Existing local lists remain usable only for queued legacy jobs. Each project must explicitly declare its repositories; missing configuration blocks dispatch with a visible issue diagnostic.
 
 Codex receives the ephemeral MCP Authorization header through a child-process environment variable, never command-line arguments. Claude receives a user-only temporary MCP configuration file, deleted after execution. Provider authentication is always discovered with native status commands; Pulse receives readiness booleans and sanitized lifecycle/results, not provider sessions.
 
 ## Signing and rollout
 
-Backend `RUNNER_JOB_SIGNING_PRIVATE_KEY` must already exist before deployment, be Ed25519, and match this release's `keys/runner-job-v1-public.pem` and `runner-job-v1` key ID. `contextRepos` is included in the signed envelope. Unknown keys, malformed/future/expired timestamps, invalid identities or unauthorized repositories are rejected before worktree creation. Older HMAC envelopes without algorithm/key ID are deliberately rejected; never reinterpret them locally. Before changing the signing format or key, drain/cancel queued jobs and update Runners together with the backend; current envelopes expire after 30 minutes.
+Backend `RUNNER_JOB_SIGNING_PRIVATE_KEY` must already exist before deployment, be Ed25519, and match this release's `keys/runner-job-v1-public.pem` and `runner-job-v1` key ID. `contextRepos` is included in the signed envelope. Unknown keys, malformed/future/expired timestamps, invalid identities or unauthorized repositories are rejected before worktree creation. Older HMAC envelopes without algorithm/key ID are deliberately rejected; never reinterpret them locally. Project-scoped jobs use `protocolVersion: 2` and sign both that version and `projectId`. They retain the existing public key and `runner-job-v1` key ID. This Runner also validates queued legacy envelopes using their original payload, without rewriting signatures. Unknown protocol versions are rejected.
+
+Upgrade with `pulse-runner service stop`, `npm install -g @pulsehub/runner@latest`, `pulse-runner service install`, then `pulse-runner diagnose`. Keep the existing data directory, pairing credential and signing key configuration. The heartbeat reports `jobProtocolVersion: 2`; the backend blocks older Runners before enqueue with these upgrade instructions. Publish and update the Runner before deploying the backend. No re-pairing or `repo add` is required.
 
 Upgrade Runners before enabling the cancellation UI/backend. Older Runners do not observe cancellation requests while their CLI runs, even if the backend revokes MCP access. The backend transaction preserves a requested cancellation if a completion races it. This version retains the TES-304 readiness and Dev/QA identity requirements.
 
 ## Verification
 
 `npm test` runs native fixture CLIs for both providers against a loopback control plane and real temporary Git repositories. It covers native session detection, signed envelope rejection before checkout, multi-repo isolation, remote/local/revocation/expiry cancellation, process descendants, sanitized reports, temporary-file cleanup, lock exclusion, interrupted-job recovery and QA permissions. The CI matrix runs the suite and CLI smoke on macOS, Linux and Windows. Fixture tests do not prove live model execution or actual service installation in each OS session.
+
+## Local profiles
+
+Profiles select local directories and an optional provider model; they do not grant repository access. The Runner checks that a directory is a repository root with a GitHub origin matching a signed job repository, then creates a disposable worktree. The source checkout and its uncommitted changes remain untouched. Cancellation and restart recovery prune these worktree registrations too.
+
+```sh
+pulse-runner profile set --repo owner/repo --directory /absolute/repository/root
+pulse-runner profile set --model MODEL_SUPPORTED_BY_YOUR_PROVIDER
+pulse-runner profile list
+pulse-runner profile remove --repo owner/repo
+```
+
+Profiles are scoped by workspace and agent and saved locally with owner-only permissions. `--model` requires support in the installed provider CLI. Repository access probes run locally for the signed job context before checkout; no provider sessions are sent to Pulse.
+
+### QA de proyectos con repos privados
+
+QA requiere Python 3 además del CLI y su sesión local (Codex o Claude).
+Los snapshots completos se descargan por `pulseQaSource` con la key efímera
+del job; la identidad GitHub de lectura permanece en el backend y se revoca
+tras cada descarga. No se requiere login global de Git/gh ni permisos duplicados
+por agente. El proyecto actual determina todos los repos; un cambio desde el
+dispatch o un head cambiado obliga a repetir el run.
+
+El manifiesto `qa-sources.json` registra cada SHA exacto. Los snapshots son de
+sólo lectura, sin `.git`; el proveedor arranca en un directorio temporal fuera
+de los repos para evitar hooks/configuraciones del código revisado. QA no corre
+scripts, builds o tests locales con la sesión del proveedor presente. Un fallo
+al preparar repos se reporta como infraestructura antes de reclamar la revisión.
+
+Los ZIPs tienen un límite de 30 MiB comprimidos/256 MiB expandidos por repo;
+enlaces, archivos especiales y traversal se rechazan con diagnóstico visible.
+La limpieza y recuperación eliminan también snapshots interrumpidos de sólo
+lectura. Este protocolo requiere desplegar la versión compatible del backend.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsehub/runner",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Local, credential-safe Pulse Runner",
   "repository": {
     "type": "git",

package/src/config.js

@@ -9,11 +9,11 @@ export function dataDir() {
   return join(process.env.XDG_DATA_HOME || join(homedir(), '.local', 'share'), 'pulse-runner');
 }
 
-export const paths = () => ({ root: dataDir(), config: join(dataDir(), 'config.json'), credential: join(dataDir(), 'device-credential'), repos: join(dataDir(), 'repos'), worktrees: join(dataDir(), 'worktrees'), logs: join(dataDir(), 'logs') });
+export const paths = () => ({ root: dataDir(), config: join(dataDir(), 'config.json'), profiles: join(dataDir(), 'agent-profiles.json'), credential: join(dataDir(), 'device-credential'), repos: join(dataDir(), 'repos'), worktrees: join(dataDir(), 'worktrees'), logs: join(dataDir(), 'logs') });
 
 export async function ensureDataDir() {
   const p = paths();
-  await Promise.all(Object.values(p).filter((value) => value !== p.config && value !== p.credential).map((value) => mkdir(value, { recursive: true, mode: 0o700 })));
+  await Promise.all(Object.values(p).filter((value) => value !== p.config && value !== p.profiles && value !== p.credential).map((value) => mkdir(value, { recursive: true, mode: 0o700 })));
   return p;
 }
 
@@ -29,6 +29,17 @@ export async function writeConfig(config) {
   await chmod(p.config, 0o600);
 }
 
+export async function readProfiles() {
+  try { return JSON.parse(await readFile(paths().profiles, 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return {}; throw error; }
+}
+
+export async function writeProfiles(profiles) {
+  const p = await ensureDataDir();
+  await writeFile(p.profiles, `${JSON.stringify(profiles, null, 2)}\n`, { mode: 0o600 });
+  await chmod(p.profiles, 0o600);
+}
+
 export async function readCredential() {
   try { return (await readFile(paths().credential, 'utf8')).trim(); }
   catch (error) { if (error.code === 'ENOENT') return null; throw error; }

package/src/index.js

@@ -5,6 +5,7 @@ import { readFile } from 'node:fs/promises';
 import { readConfig, readCredential, writeConfig, writeCredential } from './config.js';
 import { sanitize } from './job.js';
 import { service } from './service.js';
+import { profileCommand } from './profile.js';
 
 import { runOnce, recoverInterruptedWork, withRunnerLock, request } from './runtime.js';
 
@@ -20,7 +21,7 @@ for (const signal of ['SIGINT', 'SIGTERM']) process.on(signal, () => {
 });
 const value = (flag) => { const i = args.indexOf(flag); return i < 0 ? undefined : args[i + 1]; };
 const has = (flag) => args.includes(flag);
-const usage = () => console.log(`pulse-runner <init|pair|start|run|diagnose|identity|repo|service>\n\ninit --workspace WS --agent AGENT [--agent-kind codex|claude] [--agent-role dev|qa] --signing-public-key FILE --allow-autonomous [--endpoint URL] [--repo owner/repo]\npair --credential runner.secret\nidentity add|remove --agent ID --agent-kind codex|claude --agent-role dev|qa | identity list\nstart | run --once | diagnose | repo add|remove|list | service install|start|stop|status|uninstall`);
+const usage = () => console.log(`pulse-runner <init|pair|start|run|diagnose|identity|repo|profile|service>\n\ninit --workspace WS --agent AGENT [--agent-kind codex|claude] [--agent-role dev|qa] --signing-public-key FILE --allow-autonomous [--endpoint URL] \npair --credential runner.secret\nidentity add|remove --agent ID --agent-kind codex|claude --agent-role dev|qa | identity list\nprofile list|set|remove [--model MODEL] [--repo owner/repo --directory PATH]\nstart | run --once | diagnose | service install|start|stop|status|uninstall`);
 
 async function start(config) {
   return withRunnerLock(async () => {
@@ -41,11 +42,10 @@ async function init() {
   if (!['codex', 'claude'].includes(value('--agent-kind') || 'codex') || !['dev', 'qa'].includes(value('--agent-role') || 'dev')) throw new Error('init requires a valid --agent-kind codex|claude and --agent-role dev|qa.');
   const { publicKey } = generateKeyPairSync('ed25519'); const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
   const signingPublicKey = await readFile(publicKeyPath, 'utf8');
-  await writeConfig({ version: 1, endpoint: value('--endpoint') || DEFAULT_ENDPOINT, workspaceId: value('--workspace'), agentId: value('--agent'), agentKind: value('--agent-kind') || 'codex', agentRole: value('--agent-role') || 'dev', signingKeyId: value('--signing-key-id') || 'runner-job-v1', signingPublicKey, repos: args.filter((item, index) => args[index - 1] === '--repo'), autonomousConfirmed: true });
+  await writeConfig({ version: 1, endpoint: value('--endpoint') || DEFAULT_ENDPOINT, workspaceId: value('--workspace'), agentId: value('--agent'), agentKind: value('--agent-kind') || 'codex', agentRole: value('--agent-role') || 'dev', signingKeyId: value('--signing-key-id') || 'runner-job-v1', signingPublicKey, repos: [], autonomousConfirmed: true });
   console.log(`Public key for pairing:\n${publicKeyPem}\n\nPaste it in Pulse Settings, then run: pulse-runner pair --credential <runner credential>`);
 }
-async function syncRepos(config) { await request(config, 'pulseRunnerConfigure', { connectedRepos: config.repos }); }
-async function repo(config) { const op = args[1]; const name = args[2]; if (op === 'list') return console.log(config.repos.join('\n')); if (!['add', 'remove'].includes(op) || !name || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(name)) throw new Error('Repository must be owner/repo.'); const repos = new Set(config.repos); op === 'add' ? repos.add(name) : repos.delete(name); const updated = { ...config, repos: [...repos].sort() }; await syncRepos(updated); await writeConfig(updated); }
+async function repo() { throw new Error('Repository access comes from the issue project. pulse-runner repo is deprecated.'); }
 async function diagnose(config) {
   const readiness = await inspectReadiness(config);
   console.log(JSON.stringify(readiness, null, 2));
@@ -70,6 +70,6 @@ async function identity(config) {
 try {
   if (!args.length || has('--help')) usage();
   else if (args[0] === 'init') await init();
-  else if (args[0] === 'pair') { const credential = value('--credential'); const match = credential?.match(/^(runner-[A-Za-z0-9_-]{12})\.[A-Za-z0-9_-]{32,}$/); if (!match) throw new Error('Invalid Runner credential.'); const config = await readConfig(); if (!config) throw new Error('Run pulse-runner init before pairing.'); const paired = { ...config, runnerId: match[1] }; await writeCredential(credential); await writeConfig(paired); await syncRepos(paired); console.log(`Runner ${paired.runnerId} paired.`); }
-  else { const config = await readConfig(); if (!config) throw new Error('Runner is not initialized.'); if (args[0] === 'identity') await identity(config); else if (args[0] === 'repo') await repo(config); else if (args[0] === 'diagnose') await diagnose(config); else if (args[0] === 'service') await service(args[1]); else if (args[0] === 'run') { activeJobController = new AbortController(); try { await withRunnerLock(async () => { await recoverInterruptedWork(config); await runOnce(config, { signal: activeJobController.signal }); }); } finally { activeJobController = undefined; } } else if (args[0] === 'start') await start(config); else usage(); }
+  else if (args[0] === 'pair') { const credential = value('--credential'); const match = credential?.match(/^(runner-[A-Za-z0-9_-]{12})\.[A-Za-z0-9_-]{32,}$/); if (!match) throw new Error('Invalid Runner credential.'); const config = await readConfig(); if (!config) throw new Error('Run pulse-runner init before pairing.'); const paired = { ...config, runnerId: match[1] }; await writeCredential(credential); await writeConfig(paired);  console.log(`Runner ${paired.runnerId} paired.`); }
+  else { const config = await readConfig(); if (!config) throw new Error('Runner is not initialized.'); if (args[0] === 'identity') await identity(config); else if (args[0] === 'repo') await repo(); else if (args[0] === 'profile') await profileCommand(config, args); else if (args[0] === 'diagnose') await diagnose(config); else if (args[0] === 'service') await service(args[1]); else if (args[0] === 'run') { activeJobController = new AbortController(); try { await withRunnerLock(async () => { await recoverInterruptedWork(config); await runOnce(config, { signal: activeJobController.signal }); }); } finally { activeJobController = undefined; } } else if (args[0] === 'start') await start(config); else usage(); }
 } catch (error) { console.error(`pulse-runner: ${sanitize(error.message)}`); process.exitCode = 1; }

package/src/job.js

@@ -3,7 +3,8 @@ import { verify } from 'node:crypto';
 const b64 = (value) => Buffer.from(value, 'base64url');
 export function jobPayload(job) {
   const contextRepos = [...new Set(job.contextRepos || [job.repoFullName])].sort().join(',');
-  return [job.id, job.workspaceId, job.issueId, job.agentId, job.runnerId, job.repoFullName, contextRepos, job.mode, job.issuedAt, job.expiresAt, job.signatureAlgorithm, job.signingKeyId].join('.');
+  const fields = [job.id, job.workspaceId, job.issueId, job.agentId, job.runnerId, job.repoFullName, contextRepos, job.mode, job.issuedAt, job.expiresAt, job.signatureAlgorithm, job.signingKeyId];
+  return (job.protocolVersion === 2 ? [...fields, job.protocolVersion, job.projectId] : fields).join('.');
 }
 
 /** Reject an envelope before it can cause filesystem or process activity. */
@@ -11,6 +12,8 @@ export function validateJob(job, config, agentOrNow = null, suppliedNow = Date.n
   const agent = typeof agentOrNow === 'object' && agentOrNow !== null ? agentOrNow : null;
   const now = typeof agentOrNow === 'number' ? agentOrNow : suppliedNow;
   if (!job || typeof job.signature !== 'string' || job.signatureAlgorithm !== 'ed25519' || job.signingKeyId !== config.signingKeyId) throw new Error('Job signing key is not trusted.');
+  if (job.protocolVersion !== undefined && job.protocolVersion !== 2) throw new Error('Job protocol is not supported.');
+  if (job.protocolVersion === 2 && (typeof job.projectId !== 'string' || !/^[-A-Za-z0-9_]+$/.test(job.projectId))) throw new Error('Job project is invalid.');
   if (!config.signingPublicKey || !verify(null, Buffer.from(jobPayload(job)), config.signingPublicKey, b64(job.signature))) throw new Error('Job signature is invalid.');
   const issuedAt = Date.parse(job.issuedAt);
   const expiresAt = Date.parse(job.expiresAt);
@@ -20,7 +23,7 @@ export function validateJob(job, config, agentOrNow = null, suppliedNow = Date.n
   const role = job.mode === 'review' ? 'qa' : 'dev';
   if (!identity || identity.role !== role || (agent && (agent.kind !== identity.kind || agent.role !== role))) throw new Error('Job identity does not match this Runner provider/role.');
   const contextRepos = [...new Set(job.contextRepos || [job.repoFullName])];
-  if (!contextRepos.includes(job.repoFullName) || contextRepos.some((repo) => !config.repos.includes(repo))) throw new Error('Job repository context is not allowed by this Runner.');
+  if (!contextRepos.includes(job.repoFullName) || contextRepos.some((repo) => typeof repo !== 'string' || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) || (job.protocolVersion !== 2 && !(config.repos || []).includes(repo)))) throw new Error('Job repository context is not allowed by this Runner.');
   return true;
 }
 

package/src/process.js

@@ -65,6 +65,12 @@ export function agentPermissionArgs(kind, mode) {
   return [];
 }
 
+export async function supportsModelOption(kind) {
+  if (!['codex', 'claude'].includes(kind)) return false;
+  const result = await command(resolveExecutable(kind), kind === 'codex' ? ['exec', '--help'] : ['--help'], { timeout: 10_000 }).catch(() => ({ code: 1, output: '' }));
+  return result.code === 0 && /(?:^|\s)--model(?:\s|[,=])/m.test(result.output);
+}
+
 export function mcpEndpoint(endpoint) {
   return endpoint.replace(/\/(?:pulseRunner\w*|pulseMcp)\/?$/, '').replace(/\/$/, '') + '/pulseMcp';
 }
@@ -89,19 +95,23 @@ export function providerInvocation(kind, worktree, additionalDirs, config, mcp,
 }
 
 export async function runAgent(kind, job, worktree, additionalWorktrees, config, credential, tempDir, options = {}) {
-  const context = additionalWorktrees.length
+  const reviewWorktrees = job.mode === 'review' ? [{ repo: job.repoFullName, worktree }, ...additionalWorktrees] : additionalWorktrees;
+  const context = reviewWorktrees.length
     ? job.mode === 'review'
-      ? ` Additional review worktrees for inspection: ${additionalWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}.`
-      : ` Additional writable project worktrees: ${additionalWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}. They are authorized for this same job: do not request a repository handoff. For every repository you change, create a pul/* branch in that worktree and commit the changes; the Runner will publish a PR for each changed branch.`
+      ? ` Snapshot manifest: ${join(worktree, '..', 'qa-sources.json')}. Additional review worktrees for inspection: ${reviewWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}.`
+      : ` Additional writable project worktrees: ${reviewWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}. They are authorized for this same job: do not request a repository handoff. For every repository you change, create a pul/* branch in that worktree and commit the changes; the Runner will publish a PR for each changed branch.`
     : '';
   const prompt = job.mode === 'review'
-    ? `You are Pulse Runner performing a QA review for issue ${job.issueId}. First call pulse_next_review with identifier "${job.issueId}"; if found is false, stop without reviewing. Then call pulse_get_review_context with the same identifier. Review every pull request and its diff returned by that tool, along with the issue acceptance criteria and project Definition of Done. Use the provided local worktrees only to inspect files when a diff is too large or more context is needed. Do not modify files, commit, push, or create pull requests. Submit the evidence-based verdict with pulse_submit_review. If you cannot submit a verdict for any reason, call pulse_report_review_incomplete before ending. Do not print, persist, or transmit credentials.${context}`
+    ? `You are Pulse Runner performing a QA review for issue ${job.issueId}. First call pulse_next_review with identifier "${job.issueId}"; if found is false, stop without reviewing. Then call pulse_get_review_context with the same identifier. Review every pull request and its diff returned by that tool, along with the issue acceptance criteria and project Definition of Done. Use the provided local worktrees only to inspect files when a diff is too large or more context is needed. Snapshots are read-only and have no Git identity. Do not install dependencies or run build/tests/scripts from the reviewed code: provider sessions are present. Do not modify files, commit, push, or create pull requests. Submit the evidence-based verdict with pulse_submit_review. If you cannot submit a verdict for any reason, call pulse_report_review_incomplete before ending. Do not print, persist, or transmit credentials.${context}`
     : `You are Pulse Runner executing ${job.mode} for issue ${job.issueId}. Use the Pulse MCP server for issue context and reporting. Work only in the provided project worktrees. Do not print, persist, or transmit credentials.${context}`;
   const mcp = await mcpConfig(tempDir, credential, config.endpoint);
-  const additionalDirs = additionalWorktrees.flatMap(({ worktree: path }) => ['--add-dir', path]);
+  const additionalDirs = reviewWorktrees.flatMap(({ worktree: path }) => ['--add-dir', path]);
   try {
-    const invocation = providerInvocation(kind, worktree, additionalDirs, config, mcp, prompt, job.mode);
+    // Start QA outside every snapshot so repository CLI settings/hooks cannot run.
+    const agentDirectory = job.mode === 'review' ? tempDir : worktree;
+    const invocation = providerInvocation(kind, agentDirectory, additionalDirs, config, mcp, prompt, job.mode);
+    if (options.profile?.model) invocation.args.splice(kind === 'codex' ? 1 : 0, 0, '--model', options.profile.model);
     const env = kind === 'codex' ? { ...process.env, PULSE_RUNNER_MCP_CREDENTIAL: `Bearer ${credential}` } : process.env;
-    return await command(invocation.executable, invocation.args, { cwd: worktree, env, signal: options.signal });
+    return await command(invocation.executable, invocation.args, { cwd: agentDirectory, env, signal: options.signal });
   } finally { await rm(mcp, { force: true }); }
 }

package/src/profile.js

@@ -0,0 +1,63 @@
+import { realpath } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { readProfiles, writeProfiles } from './config.js';
+import { command, supportsModelOption } from './process.js';
+export const profileKey = (config) => `${config.workspaceId}:${config.agentId}`;
+const validModel = (model) => typeof model === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(model);
+function remoteRepo(remote) {
+  const match = String(remote || '').trim().match(/^(?:https:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/i);
+  return match?.[1]?.toLowerCase();
+}
+export async function validateLocalRepo(config, repo, directory, authorizedRepos) {
+  if (!repo || (authorizedRepos && !authorizedRepos.includes(repo))) throw new Error('Repository is not authorized by the signed project context.');
+  const path = await realpath(resolve(directory));
+  const rootResult = await command('git', ['-C', path, 'rev-parse', '--show-toplevel']);
+  if (rootResult.code) throw new Error('Selected directory is not an accessible Git repository.');
+  const root = await realpath(rootResult.output.trim());
+  if (path !== root) throw new Error('Select the repository root directory.');
+  const remoteResult = await command('git', ['-C', root, 'remote', 'get-url', 'origin']);
+  if (remoteResult.code || remoteRepo(remoteResult.output) !== repo.toLowerCase()) throw new Error('Selected directory origin does not match the allowed repository.');
+  return root;
+}
+export async function agentProfile(config) {
+  const profiles = await readProfiles();
+  return profiles[profileKey(config)] || {};
+}
+export async function resolveProfile(config, job) {
+  const profile = await agentProfile({ ...config, agentId: job.agentId });
+  if (profile.model && !validModel(profile.model)) throw new Error('Configured model name is invalid.');
+  if (profile.model && !(await supportsModelOption(config.agentKind))) throw new Error(`The installed ${config.agentKind} CLI does not support the --model option.`);
+  const directory = job.mode === 'review' ? undefined : profile.directories?.[job.repoFullName];
+  if (!directory) return { ...profile, directory: undefined };
+  return { ...profile, directory: await validateLocalRepo(config, job.repoFullName, directory, job.contextRepos || [job.repoFullName]) };
+}
+
+export async function profileCommand(config, args) {
+  const value = (flag) => { const i = args.indexOf(flag); return i < 0 ? undefined : args[i + 1]; };
+  const op = args[1]; const profiles = await readProfiles(); const key = profileKey(config);
+  const current = profiles[key] || { directories: {} };
+  if (op === 'list') return console.log(JSON.stringify(current, null, 2));
+  if (op === 'set') {
+    const updated = { ...current, directories: { ...(current.directories || {}) } };
+    const model = value('--model'); const repo = value('--repo'); const directory = value('--directory');
+    if (!model && !directory) throw new Error('profile set requires --model and/or --directory.');
+    if (repo && !directory) throw new Error('--repo requires --directory when setting a profile.');
+    if (model) {
+      if (!validModel(model)) throw new Error('Model name is invalid; use letters, numbers, dot, underscore, colon, slash or hyphen.');
+      if (!(await supportsModelOption(config.agentKind))) throw new Error(`The installed ${config.agentKind} CLI does not support the --model option.`);
+      updated.model = model;
+    }
+    if (directory) {
+      if (!repo) throw new Error('--directory requires --repo owner/repo.');
+      updated.directories[repo] = await validateLocalRepo(config, repo, directory);
+    }
+    profiles[key] = updated; await writeProfiles(profiles); return console.log('Local agent profile saved.');
+  }
+  if (op === 'remove') {
+    const repo = value('--repo');
+    if (repo) { delete current.directories?.[repo]; if (current.model || Object.keys(current.directories || {}).length) profiles[key] = current; else delete profiles[key]; }
+    else delete profiles[key];
+    await writeProfiles(profiles); return console.log('Local agent profile updated.');
+  }
+  throw new Error('Supported profile commands: list, set, remove.');
+}

package/src/qa-source.py

@@ -0,0 +1,120 @@
+"""Trusted preparation, shared with the generated Actions workflow. No repo code runs."""
+import io
+import json
+import os
+from pathlib import Path, PurePosixPath
+import stat
+import sys
+import urllib.error
+import urllib.request
+import zipfile
+
+
+def call(body):
+    request = urllib.request.Request(os.environ['PULSE_QA_SOURCE_URL'],
+        data=json.dumps(body).encode(), headers={
+            'Authorization': 'Bearer ' + os.environ['PULSE_QA_CREDENTIAL'],
+            'Content-Type': 'application/json'})
+    try:
+        with urllib.request.urlopen(request, timeout=540) as response:
+            return response.read(30 * 1024 * 1024 + 1)
+    except urllib.error.HTTPError as error:
+        # Only structured infrastructure diagnostics; never echo headers or URLs.
+        try:
+            diagnostic = json.loads(error.read())
+            problems = diagnostic.get('problems') or [{'message': diagnostic.get('message', 'acceso denegado')}]
+            raise RuntimeError('; '.join((p.get('repo', '') + ': ' if p.get('repo') and not p['message'].startswith(p['repo']) else '') + p['message'] for p in problems)) from None
+        except (ValueError, KeyError):
+            raise RuntimeError('QA infrastructure HTTP %d' % error.code) from None
+
+
+def extract(data, target):
+    with zipfile.ZipFile(io.BytesIO(data)) as archive:
+        total = 0
+        entries = []
+        roots = set()
+        for entry in archive.infolist():
+            path = PurePosixPath(entry.filename)
+            mode = entry.external_attr >> 16
+            if path.is_absolute() or '..' in path.parts or '\\' in entry.filename:
+                raise RuntimeError('Snapshot con ruta insegura')
+            roots.add(path.parts[0])
+            if stat.S_ISLNK(mode) or (stat.S_IFMT(mode) not in (0, stat.S_IFREG, stat.S_IFDIR)):
+                raise RuntimeError('Snapshot con enlace o archivo especial')
+            if '.git' in path.parts:
+                raise RuntimeError('Snapshot con metadatos Git')
+            total += entry.file_size
+            if total > 256 * 1024 * 1024:
+                raise RuntimeError('Snapshot expandido supera 256 MiB')
+            entries.append((entry, path.parts[1:]))
+        if len(roots) != 1:
+            raise RuntimeError('Snapshot sin raíz única')
+        target.mkdir(parents=True)
+        for entry, parts in entries:
+            if not parts:
+                continue
+            dest = target.joinpath(*parts)
+            if entry.is_dir():
+                dest.mkdir(parents=True, exist_ok=True)
+            else:
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                with dest.open('xb') as output:
+                    output.write(archive.read(entry))
+                dest.chmod(0o444)
+        for directory in sorted((p for p in target.rglob('*') if p.is_dir()), reverse=True):
+            directory.chmod(0o555)
+        target.chmod(0o555)
+
+
+def main():
+    identifier = os.environ['PULSE_QA_IDENTIFIER']
+    root = Path(os.environ['PULSE_QA_ROOT'])
+    manifest = json.loads(call({'identifier': identifier}))
+    expected = json.loads(os.environ.get('PULSE_QA_EXPECTED_REPOS', 'null'))
+    if expected is not None and sorted(expected) != sorted(r['repo'] for r in manifest['repositories']):
+        raise RuntimeError('El proyecto cambió desde el dispatch; repetí el run')
+    primary = os.environ.get('PULSE_QA_PRIMARY_REPO')
+    primary_snapshot = next((r for r in manifest['repositories'] if r['repo'] == primary), None)
+    if os.environ.get('PULSE_QA_MANIFEST_ONLY') == '1':
+        if not primary_snapshot:
+            raise RuntimeError('Repositorio anfitrión fuera del proyecto')
+        with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+            output.write('head_sha=' + primary_snapshot['sha'] + '\n')
+        return
+    expected_head = os.environ.get('PULSE_QA_EXPECTED_PRIMARY_SHA')
+    if expected_head and (not primary_snapshot or primary_snapshot['sha'] != expected_head):
+        raise RuntimeError('El head cambió desde verify; repetí el run')
+    for snapshot in manifest['repositories']:
+        repo = snapshot['repo']
+        parts = repo.split('/')
+        if len(parts) != 2 or any(not part or any(c not in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.-' for c in part) for part in parts):
+            raise RuntimeError('Repositorio inválido en snapshot')
+        archive = call({'identifier': identifier, 'repo': repo, 'sha': snapshot['sha']})
+        extract(archive, root / repo.replace('/', '__'))
+    root.mkdir(parents=True, exist_ok=True)
+    (root / 'qa-sources.json').write_text(json.dumps(manifest))
+    print('QA sources ready.')
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except Exception as error:
+        # Infrastructure is reported before claiming/evaluating a review.
+        try:
+            body = {'jsonrpc': '2.0', 'id': 1, 'method': 'tools/call', 'params': {'name': 'pulse_comment_issue', 'arguments': {'identifier': os.environ['PULSE_QA_IDENTIFIER'], 'body': 'QA no arrancó: fallo de infraestructura al preparar repositorios. ' + str(error)}}}
+            request = urllib.request.Request(os.environ['PULSE_QA_SOURCE_URL'].replace('/pulseQaSource', '/pulseMcp'), data=json.dumps(body).encode(), headers={'Authorization': 'Bearer ' + os.environ['PULSE_QA_CREDENTIAL'], 'Content-Type': 'application/json', 'Accept': 'application/json, text/event-stream'})
+            with urllib.request.urlopen(request, timeout=30):
+                pass
+        except Exception:
+            pass
+        if os.environ.get('PULSE_QA_RUN_ID'):
+            try:
+                body = {'jsonrpc': '2.0', 'id': 2, 'method': 'tools/call', 'params': {'name': 'pulse_report_run', 'arguments': {'runId': os.environ['PULSE_QA_RUN_ID'], 'outcome': 'failed'}}}
+                request = urllib.request.Request(os.environ['PULSE_QA_SOURCE_URL'].replace('/pulseQaSource', '/pulseMcp'), data=json.dumps(body).encode(), headers={'Authorization': 'Bearer ' + os.environ['PULSE_QA_CREDENTIAL'], 'Content-Type': 'application/json', 'Accept': 'application/json, text/event-stream'})
+                with urllib.request.urlopen(request, timeout=30):
+                    pass
+            except Exception:
+                pass
+        print('QA infrastructure: ' + str(error), file=sys.stderr)
+        sys.exit(1)

package/src/readiness.js

@@ -18,12 +18,12 @@ export async function inspectReadiness(config, run = command) {
     providers[kind] = { cli, session: !!session };
   }
   const repositories = [];
-  for (const repo of config.repos) {
+  for (const repo of config.repos || []) {
     if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo)) throw new Error('Invalid repository.');
     const accessible = await run('git', ['ls-remote', '--exit-code', `https://github.com/${repo}.git`, 'HEAD'], { env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, timeout: 10_000, maxOutput: 4096 }).then((result) => result.code === 0).catch(() => false);
     repositories.push({ repo, accessible });
   }
-  return { workspaceId: config.workspaceId, identities: localIdentities(config), providers, repositories };
+  return { workspaceId: config.workspaceId, identities: localIdentities(config), providers, repositories, jobProtocolVersion: 2, qaSourceProtocolVersion: 1 };
 }
 
 export function assertLocalReadiness(job, config, agent, readiness) {
@@ -31,5 +31,5 @@ export function assertLocalReadiness(job, config, agent, readiness) {
   const role = job.mode === 'review' ? 'qa' : 'dev';
   if (!identity || identity.kind !== agent.kind || identity.role !== role || agent.role !== role) throw new Error('Local agent identity/provider/role mismatch. Run pulse-runner identity add with this agent configuration.');
   if (!readiness.providers[agent.kind]?.cli || !readiness.providers[agent.kind]?.session) throw new Error(`Local ${agent.kind} CLI/session is unavailable. Sign in locally and run pulse-runner diagnose.`);
-  if ((job.contextRepos || [job.repoFullName]).some((repo) => !readiness.repositories.some((entry) => entry.repo === repo && entry.accessible))) throw new Error('Local repository access is unavailable. Check Git authentication and run pulse-runner diagnose.');
+  if (job.mode !== 'review' && (job.contextRepos || [job.repoFullName]).some((repo) => !readiness.repositories.some((entry) => entry.repo === repo && entry.accessible))) throw new Error('Local repository access is unavailable. Check Git authentication and run pulse-runner diagnose.');
 }

package/src/runtime.js

@@ -1,9 +1,11 @@
 import { appendFile, chmod, mkdir, open, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
 import { join } from 'node:path';
-import { ensureDataDir, paths, readCredential, removeTemporary } from './config.js';
+import { ensureDataDir, paths, readCredential, readProfiles, removeTemporary } from './config.js';
 import { validateJob, sanitize } from './job.js';
 import { command, resolveExecutable, runAgent } from './process.js';
 import { addIsolatedWorktree, removeIsolatedWorktree } from './worktree.js';
+import { resolveProfile, validateLocalRepo } from './profile.js';
 import { inspectReadiness, assertLocalReadiness, localIdentities } from './readiness.js';
 
 export async function logEvent(event, details = {}) {
@@ -48,7 +50,8 @@ function completionSummary(result, publication) {
   const detailBudget = detailCount ? Math.max(0, Math.floor((480 - prefixSize) / detailCount)) : 0;
   return entries.map(({ label, detail }) => detail && detailBudget ? `${label}: ${detail.slice(-detailBudget)}` : label).join('\n').slice(-500);
 }
-async function checkoutRepo(repo, worktree, signal) {
+async function checkoutRepo(repo, worktree, signal, sourceDirectory) {
+  if (sourceDirectory) return addIsolatedWorktree(repo, sourceDirectory, worktree, { signal, sourceDirectory });
   const p = paths(); const mirror = join(p.repos, `${repoPath(repo)}.git`);
   const existing = await command('git', ['--git-dir', mirror, 'rev-parse', '--git-dir']).catch(() => ({ code: 1, output: '' }));
   if (existing.code !== 0) {
@@ -59,11 +62,12 @@ async function checkoutRepo(repo, worktree, signal) {
   return addIsolatedWorktree(repo, mirror, worktree, { signal });
 }
 async function checkout(job, options = {}) {
+  if (job.mode === 'review') return checkoutQa(job, options);
   const root = join(paths().worktrees, job.id); const repos = [...new Set(job.contextRepos || [job.repoFullName])]; const checkouts = [];
   await mkdir(root, { recursive: true, mode: 0o700 });
   try {
     for (const repo of repos) {
-      const checkout = await checkoutRepo(repo, join(root, repoPath(repo)), options.signal);
+      const checkout = await checkoutRepo(repo, join(root, repoPath(repo)), options.signal, repo === job.repoFullName ? options.profile?.directory : undefined);
       await writeFile(join(checkout.worktree, '.pulse-runner-job'), job.id, { mode: 0o600 });
       checkouts.push(checkout);
     }
@@ -72,13 +76,35 @@ async function checkout(job, options = {}) {
     return { primary, checkouts };
   } catch (error) { await cleanup(checkouts); await removeTemporary(root); throw error; }
 }
+export async function checkoutQa(job, options = {}) {
+  const root = join(paths().worktrees, job.id);
+  const result = await command('python3', [fileURLToPath(new URL('./qa-source.py', import.meta.url))], {
+    signal: options.signal, timeout: 540_000,
+    env: { ...process.env, PULSE_QA_SOURCE_URL: options.config.endpoint.replace(/\/$/, '') + '/pulseQaSource',
+      PULSE_QA_CREDENTIAL: options.credential, PULSE_QA_IDENTIFIER: job.issueId, PULSE_QA_ROOT: root,
+      PULSE_QA_EXPECTED_REPOS: JSON.stringify(job.contextRepos || [job.repoFullName]) },
+  });
+  if (result.code !== 0) { await makeWritable(root).catch(() => {}); await removeTemporary(root); throw new Error(sanitize(result.output)); }
+  const manifest = JSON.parse(await readFile(join(root, 'qa-sources.json'), 'utf8'));
+  const checkouts = manifest.repositories.map(({ repo, sha }) => ({ repo, worktree: join(root, repoPath(repo)), baseCommit: sha, snapshot: true }));
+  const primary = checkouts.find((entry) => entry.repo === job.repoFullName);
+  if (!primary) throw new Error('QA snapshot target is missing.');
+  return { primary, checkouts };
+}
+async function makeWritable(path) {
+  await chmod(path, 0o700);
+  for (const entry of await readdir(path, { withFileTypes: true })) if (entry.isDirectory()) await makeWritable(join(path, entry.name));
+}
 async function cleanup(checkouts) {
-  await Promise.all(checkouts.map(async ({ worktree, mirror }) => {
-    await removeIsolatedWorktree({ mirror, worktree });
+  await Promise.all(checkouts.map(async ({ worktree, mirror, sourceDirectory, snapshot }) => {
+    if (snapshot) {
+      await makeWritable(worktree); await removeTemporary(worktree); return;
+    }
+    await removeIsolatedWorktree({ mirror, worktree, sourceDirectory });
     await removeTemporary(worktree);
   }));
 }
-async function publishCheckout(checkout, jobId, checkActive, signal) {
+async function publishCheckout(checkout, jobId, issueId, checkActive, signal) {
   const branchResult = await command('git', ['-C', checkout.worktree, 'branch', '--show-current'], { signal });
   const branch = branchResult.output.trim();
   if (!branch || !branch.startsWith('pul/')) {
@@ -96,12 +122,15 @@ async function publishCheckout(checkout, jobId, checkActive, signal) {
     await logEvent('publication.skipped', { jobId, repo: checkout.repo, branch, reason: 'no-commits' });
     return '';
   }
+  const subject = await command('git', ['-C', checkout.worktree, 'log', '-1', '--format=%s'], { signal });
+  if (subject.code !== 0) throw Object.assign(new Error(sanitize(subject.output)), { phase });
+  const pullRequestTitle = sanitize(subject.output.trim().replace(/\s+/g, ' ')).slice(0, 120) || 'Pulse Runner update';
   // Sólo se publica una rama de trabajo Pulse de un worktree firmado como
   // contexto de este job. El Runner no elige repos ni destinos externos.
   phase = 'push';
   await logEvent('publication.started', { jobId, repo: checkout.repo, branch, phase });
   await checkActive();
-  const pushed = await command('git', ['-c', 'remote.origin.mirror=false', '--git-dir', checkout.mirror, 'push', 'origin', `refs/heads/${branch}:refs/heads/${branch}`], { signal, timeout: 120_000 });
+  const pushed = await command('git', [...(checkout.sourceDirectory ? ['-C', checkout.worktree] : ['-c', 'remote.origin.mirror=false', '--git-dir', checkout.mirror]), 'push', 'origin', `refs/heads/${branch}:refs/heads/${branch}`], { signal, timeout: 120_000 });
   if (pushed.code !== 0) throw Object.assign(new Error(sanitize(pushed.output)), { phase });
   await logEvent('publication.pushed', { jobId, repo: checkout.repo, branch, phase });
   phase = 'find-pull-request';
@@ -113,16 +142,17 @@ async function publishCheckout(checkout, jobId, checkActive, signal) {
   if (!/no pull requests found/i.test(existing.output)) throw Object.assign(new Error(sanitize(existing.output)), { phase });
   phase = 'create-pull-request';
   await checkActive();
-  const created = await command(resolveExecutable('gh'), ['pr', 'create', '--repo', checkout.repo, '--base', 'main', '--head', branch, '--fill'], { signal, timeout: 30_000 });
+  const pullRequestBody = `Automated changes from Pulse Runner for issue ${sanitize(issueId)}.`;
+  const created = await command(resolveExecutable('gh'), ['pr', 'create', '--repo', checkout.repo, '--base', 'main', '--head', branch, '--title', pullRequestTitle, '--body', pullRequestBody], { signal, timeout: 30_000 });
   if (created.code !== 0) throw Object.assign(new Error(sanitize(created.output)), { phase });
   await logEvent('publication.pull-request-created', { jobId, repo: checkout.repo, branch, url: created.output.trim() });
   return `Published ${checkout.repo}:${branch}; ${created.output.trim()}`;
 }
-async function publish(checkouts, jobId, checkActive, signal) {
+async function publish(checkouts, jobId, issueId, checkActive, signal) {
   const publications = { succeeded: [], failed: [] };
   for (const checkout of checkouts) {
     try {
-      const published = await publishCheckout(checkout, jobId, checkActive, signal);
+      const published = await publishCheckout(checkout, jobId, issueId, checkActive, signal);
       if (published) publications.succeeded.push(published);
     } catch (error) {
       if (error.name === 'AbortError') throw error;
@@ -175,7 +205,9 @@ export async function runOnce(config, options = {}) {
     const agent = delivery.agent || { kind: config.agentKind, role: job.agentId === config.agentId ? 'dev' : null };
     validateJob(job, config, agent);
     jobPhase = 'local-preflight';
-    assertLocalReadiness(job, config, agent, await readinessForJob(config, true));
+    const profile = await resolveProfile({ ...config, agentKind: agent.kind }, job);
+    const jobConfig = job.protocolVersion === 2 ? { ...config, repos: job.contextRepos || [job.repoFullName] } : config;
+    assertLocalReadiness(job, jobConfig, agent, await readinessForJob(jobConfig, true));
     await logEvent('job.validated', { jobId: job.id, repoCount: (job.contextRepos || [job.repoFullName]).length });
     await checkActive();
     expiryTimer = setTimeout(cancel, Math.max(0, Date.parse(job.expiresAt) - Date.now()));
@@ -196,19 +228,19 @@ export async function runOnce(config, options = {}) {
     jobPhase = 'prepare-worktrees';
     await writeFile(journal, JSON.stringify({ jobId: job.id }), { mode: 0o600 });
     await chmod(journal, 0o600);
-    const { primary, checkouts } = await prepare(job, { signal: controller.signal });
+    const { primary, checkouts } = await prepare(job, { signal: controller.signal, profile, config, credential: delivery.mcpCredential });
     const temp = join(paths().root, 'tmp', job.id);
     let completion;
     try {
       controller.signal.throwIfAborted();
       jobPhase = 'run-agent';
       await logEvent('agent.started', { jobId: job.id, repo: primary.repo, mode: job.mode });
-      const result = await runAgent(agent.kind, job, primary.worktree, checkouts.filter((entry) => entry !== primary), config, delivery.mcpCredential, temp, { signal: controller.signal });
+      const result = await runAgent(agent.kind, job, primary.worktree, checkouts.filter((entry) => entry !== primary), config, delivery.mcpCredential, temp, { signal: controller.signal, profile });
       controller.signal.throwIfAborted();
       await checkActive();
       await logEvent(result.code === 0 ? 'agent.completed' : 'agent.failed', { jobId: job.id, exitCode: result.code, ...(result.code === 0 ? {} : { error: failureDetail(result.output) }) });
       jobPhase = 'publication';
-      const publication = result.code === 0 && job.mode !== 'review' ? await publishWork(checkouts, job.id, checkActive, controller.signal) : { succeeded: [], failed: [] };
+      const publication = result.code === 0 && job.mode !== 'review' ? await publishWork(checkouts, job.id, job.issueId, checkActive, controller.signal) : { succeeded: [], failed: [] };
       await checkActive();
       const outcome = result.code === 0 && publication.failed.length === 0 ? 'completed' : 'failed';
       const failure = outcome === 'failed' ? { phase: result.code !== 0 ? 'run-agent' : publication.failed[0]?.phase || 'publication', category: 'execution', correlationId: job.id } : null;
@@ -249,10 +281,17 @@ export async function recoverInterruptedWork(config) {
   for (const area of [p.worktrees, join(p.root, 'tmp')]) {
     await mkdir(area, { recursive: true, mode: 0o700 });
     const jobs = await readdir(area, { withFileTypes: true });
-    await Promise.all(jobs.map((entry) => rm(join(area, entry.name), { recursive: true, force: true })));
+    await Promise.all(jobs.map(async (entry) => { if (entry.isDirectory()) await makeWritable(join(area, entry.name)); await rm(join(area, entry.name), { recursive: true, force: true }); }));
   }
   const repositories = await readdir(p.repos, { withFileTypes: true });
   await Promise.all(repositories.filter((entry) => entry.isDirectory()).map((entry) => command('git', ['--git-dir', join(p.repos, entry.name), 'worktree', 'prune']).catch(() => {})));
+  const profiles = await readProfiles();
+  for (const profile of Object.values(profiles)) {
+    for (const [repo, directory] of Object.entries(profile.directories || {})) {
+      const source = await validateLocalRepo(config, repo, directory).catch(() => null);
+      if (source) await command('git', ['-C', source, 'worktree', 'prune']).catch(() => {});
+    }
+  }
   if (config) {
     const journal = join(p.root, 'active-job.json');
     const interrupted = await readFile(journal, 'utf8').then(JSON.parse).catch((error) => {
@@ -288,5 +327,3 @@ export async function withRunnerLock(run) {
   try { await lock.writeFile(`${process.pid}\n`); return await run(); }
   finally { await lock.close(); await rm(lockPath, { force: true }); }
 }
-
-

package/src/service.js

@@ -81,4 +81,3 @@ export async function service(action, options = {}) {
   }
   throw new Error('Supported service commands: install, start, stop, status, uninstall.');
 }
-

package/src/worktree.js

@@ -3,16 +3,17 @@ import { sanitize } from './job.js';
 
 export async function addIsolatedWorktree(repo, gitDir, worktree, options = {}) {
   options.signal?.throwIfAborted();
-  const added = await command('git', ['--git-dir', gitDir, 'worktree', 'add', '--detach', worktree, 'HEAD'], options);
+  const prefix = options.sourceDirectory ? ['-C', options.sourceDirectory] : ['--git-dir', gitDir];
+  const added = await command('git', [...prefix, 'worktree', 'add', '--detach', worktree, 'HEAD'], options);
   if (added.code !== 0) throw new Error(sanitize(added.output));
   const base = await command('git', ['-C', worktree, 'rev-parse', 'HEAD'], options);
   if (base.code !== 0) {
-    await command('git', ['--git-dir', gitDir, 'worktree', 'remove', '--force', worktree]).catch(() => {});
+    await command('git', [...prefix, 'worktree', 'remove', '--force', worktree]).catch(() => {});
     throw new Error(sanitize(base.output));
   }
-  return { repo, mirror: gitDir, worktree, baseCommit: base.output.trim() };
+  return { repo, mirror: options.sourceDirectory ? null : gitDir, sourceDirectory: options.sourceDirectory, worktree, baseCommit: base.output.trim() };
 }
 
 export async function removeIsolatedWorktree(checkout) {
-  await command('git', ['--git-dir', checkout.mirror, 'worktree', 'remove', '--force', checkout.worktree]).catch(() => {});
+  await command('git', [...(checkout.sourceDirectory ? ['-C', checkout.sourceDirectory] : ['--git-dir', checkout.mirror]), 'worktree', 'remove', '--force', checkout.worktree]).catch(() => {});
 }

package/test/integration.test.js

@@ -2,9 +2,11 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { generateKeyPairSync, sign } from 'node:crypto';
 import { createServer } from 'node:http';
-import { mkdtemp, mkdir, readFile, writeFile, rm, access } from 'node:fs/promises';
+import { mkdtemp, mkdir, readFile, writeFile, rm, access, realpath } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { validateLocalRepo } from '../src/profile.js';
 import { paths, ensureDataDir, writeCredential } from '../src/config.js';
 import { jobPayload } from '../src/job.js';
 import { command } from '../src/process.js';
@@ -27,13 +29,14 @@ import { spawn, spawnSync } from 'node:child_process';
 const args = process.argv.slice(2);
 const settings = JSON.parse(readFileSync(${JSON.stringify(join(root, 'settings.json'))}, 'utf8'));
 if (args.includes('--version')) console.log('fixture-cli');
+else if (args.includes('--help')) console.log('--model MODEL');
 else if (args[0] === 'login') process.exit(settings.session ? 0 : 1);
 else if (args[0] === 'auth') console.log(JSON.stringify({loggedIn: settings.session}));
 else {
   const file = args[args.indexOf('--mcp-config') + 1];
   const received = args.includes('exec') ? !!process.env.PULSE_RUNNER_MCP_CREDENTIAL?.startsWith('Bearer ') : !!JSON.parse(readFileSync(file)).mcpServers.pulse.headers.Authorization;
   const child = settings.slow ? spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], {stdio:'ignore'}) : null;
-  writeFileSync(${JSON.stringify(trace)}, JSON.stringify({args, received, pid: process.pid, childPid: child?.pid}));
+  writeFileSync(${JSON.stringify(trace)}, JSON.stringify({args, received, cwd: process.cwd(), pid: process.pid, childPid: child?.pid}));
   writeFileSync('job-output.txt', 'isolated output');
   if (settings.publish) {
     for (const argv of [['switch','-c','pul/fixture'],['add','job-output.txt'],['-c','user.name=Fixture','-c','user.email=fixture@example.invalid','commit','-m','fixture job']]) {
@@ -72,11 +75,19 @@ else console.log('https://github.com/owner/repo/pull/123');
   signJob();
   const calls = [];
   const control = { cancel: false, cancelWhenRunning: false, disconnectWhenRunning: false };
+  const zipResult = await command('python3', ['-c', "import io,zipfile,base64; b=io.BytesIO(); z=zipfile.ZipFile(b,'w'); z.writestr('snapshot/source.txt','QA fixture'); z.close(); print(base64.b64encode(b.getvalue()).decode())"]);
+  assert.equal(zipResult.code, 0);
+  const archive = Buffer.from(zipResult.output.trim(), 'base64');
   const server = createServer(async (req, res) => {
     let raw = ''; for await (const chunk of req) raw += chunk;
     const body = JSON.parse(raw); calls.push({path:req.url, body});
     res.setHeader('Content-Type', 'application/json');
-    if (req.url === '/pulseRunnerPoll') res.end(JSON.stringify({job, agent:{kind,role: job.mode === 'review' ? 'qa' : 'dev'}, mcpCredential:'pulse_sk_fixture'}));
+    if (req.url === '/pulseQaSource') {
+      if (control.sourceDenied) { res.statusCode=409; res.end(JSON.stringify({problems:[{repo:'owner/private-runner',message:'owner/private-runner: HTTP 403'}]})); }
+      else if (body.repo) { res.setHeader('Content-Type','application/zip'); res.end(archive); }
+      else res.end(JSON.stringify({projectId:'project-fixture',repositories:(job.contextRepos || [job.repoFullName]).map(repo=>({repo,sha:'a'.repeat(40)}))}));
+    }
+    else if (req.url === '/pulseRunnerPoll') res.end(JSON.stringify({job, agent:{kind,role: job.mode === 'review' ? 'qa' : 'dev'}, mcpCredential:'pulse_sk_fixture'}));
     else if (body.jobId && req.url === '/pulseRunnerHeartbeat') {
       const running = await exists(trace);
       if (control.disconnectWhenRunning && running) {res.statusCode=401;res.end('{}');}
@@ -190,6 +201,10 @@ test('integration: recovery prunes interrupted worktrees and temporary MCP files
   const interrupted=join(paths().worktrees,'rjob-interrupted');
   await git(['--git-dir',mirror,'worktree','add','--detach',interrupted,'HEAD']);
   await writeFile(join(interrupted,'source.txt'),'interrupted edits');
+  await git(['-C',f.source,'remote','add','origin','https://github.com/owner/repo.git']);
+  const localInterrupted=join(paths().worktrees,'rjob-local-interrupted');
+  await git(['-C',f.source,'worktree','add','--detach',localInterrupted,'HEAD']);
+  await writeFile(paths().profiles,JSON.stringify({[`${f.config.workspaceId}:${f.job.agentId}`]:{directories:{'owner/repo':f.source}}}));
   const temp=join(paths().root,'tmp','rjob-interrupted');
   await mkdir(temp,{recursive:true}); await writeFile(join(temp,'pulse-mcp.json'),'synthetic temporary data');
   await writeFile(join(paths().root, 'active-job.json'), JSON.stringify({jobId:f.job.id}));
@@ -198,6 +213,7 @@ test('integration: recovery prunes interrupted worktrees and temporary MCP files
   assert.equal(await exists(join(paths().root,'active-job.json')),false);
   f.calls.length=0;
   assert.equal(await exists(interrupted),false);
+  assert.ok(!(await git(['-C',f.source,'worktree','list','--porcelain'])).includes('rjob-local-interrupted'));
   assert.equal(await exists(temp),false);
   assert.ok(!(await git(['--git-dir',mirror,'worktree','list','--porcelain'])).includes('rjob-interrupted'));
   assert.equal(await readFile(join(f.source,'source.txt'),'utf8'),'original');
@@ -227,13 +243,16 @@ test('integration: a job expires during execution and is stopped before publicat
   assert.equal(await exists(join(paths().worktrees,f.job.id)),false);
 }));
 
-test('integration: QA execution retains read-only flags and never publishes',()=>fixture('codex',async f=>{
-  f.job.mode='review'; f.signJob();
+for (const kind of ['codex','claude']) test(`integration: ${kind} QA reads all project snapshots without global Git auth and never publishes`,()=>fixture(kind,async f=>{
+  f.job.mode='review'; f.job.contextRepos=['owner/repo','owner/app','owner/private-runner']; f.config.repos=f.job.contextRepos; f.signJob();
   f.config.agentRole='qa';
   let published=false;
   await f.run({publish:async()=>{published=true;}});
   const trace=JSON.parse(await readFile(f.trace,'utf8'));
-  assert.ok(trace.args.includes('read-only'));
+  assert.ok(trace.args.includes(kind==='codex' ? 'read-only' : 'plan'));
+  assert.match(trace.args.at(-1), /owner\/private-runner/);
+  assert.match(trace.cwd.replaceAll('\\','/'),new RegExp(`/runner/tmp/${f.job.id}$`,'i'));
+  assert.equal(f.calls.filter(c=>c.path==='/pulseQaSource' && c.body.repo).length,3);
   assert.equal(published,false);
   assert.equal(f.calls.find(c=>c.path==='/pulseRunnerComplete').body.outcome,'completed');
 }));
@@ -267,3 +286,59 @@ test('integration: committed job branches push to a local remote and report the
   assert.equal(calls[0][1],'view'); assert.equal(calls[1][1],'create');
   assert.equal(await exists(join(paths().worktrees,f.job.id)),false);
 }));
+
+
+test('integration: v2 job uses its signed repos without a local allowlist',()=>fixture('codex',async f=>{
+  f.job.protocolVersion=2;f.job.projectId='project-fixture';f.signJob();
+  f.config.repos=[];
+  const readinessFor=(config)=>inspectReadiness(config,(exe,args,options)=>command(exe,exe==='git'?['ls-remote','--exit-code',f.source,'HEAD']:args,options));
+  await f.run({readinessFor});
+  assert.equal(f.calls.find(c=>c.path==='/pulseRunnerComplete').body.outcome,'completed');
+  assert.equal(await exists(join(paths().worktrees,f.job.id)),false);
+}));
+
+test('integration: local profile worktree/model preserve source checkout and cancellation cleanup',()=>fixture('codex',async f=>{
+  await git(['-C',f.source,'remote','add','origin','https://github.com/owner/repo.git']);
+  await writeFile(paths().profiles,JSON.stringify({[`${f.config.workspaceId}:${f.job.agentId}`]:{model:'fixture-model',directories:{'owner/repo':f.source}}}));
+  f.job.protocolVersion=2;f.job.projectId='project-fixture';f.signJob();
+  f.settings.slow=true;await f.updateSettings();f.control.cancelWhenRunning=true;
+  await f.run();
+  const trace=JSON.parse(await readFile(f.trace,'utf8'));
+  assert.equal(trace.args[trace.args.indexOf('--model')+1],'fixture-model');
+  assert.equal(f.calls.find(c=>c.path==='/pulseRunnerComplete').body.outcome,'canceled');
+  assert.equal(await readFile(join(f.source,'source.txt'),'utf8'),'original');
+  assert.equal((await git(['-C',f.source,'worktree','list','--porcelain'])).split('worktree ').length-1,1);
+}));
+
+test('integration: profile origins reject lookalike hosts, foreign repos and unauthorized context',()=>fixture('codex', async f => {
+  await git(['-C', f.source, 'remote', 'add', 'origin', 'https://evilgithub.com/owner/repo.git']);
+  await assert.rejects(validateLocalRepo(f.config,'owner/repo',f.source,['owner/repo']), /origin/);
+  await git(['-C', f.source, 'remote', 'set-url', 'origin', 'https://github.com/owner/foreign.git']);
+  await assert.rejects(validateLocalRepo(f.config,'owner/repo',f.source,['owner/repo']), /origin/);
+  await git(['-C', f.source, 'remote', 'set-url', 'origin', 'git@github.com:owner/repo.git']);
+  assert.equal(await validateLocalRepo(f.config,'owner/repo',f.source,['owner/repo']),await realpath(f.source));
+  await assert.rejects(validateLocalRepo(f.config,'owner/repo',f.source,['owner/other']), /not authorized/);
+}));
+
+test('integration: CLI init, pairing and diagnose need no per-agent repo configuration',()=>fixture('codex',async f => {
+  const cli=fileURLToPath(new URL('../src/index.js',import.meta.url));
+  const home=join(f.root,'fresh-home'), key=join(f.root,'signing-public.pem');
+  await writeFile(key,f.config.signingPublicKey);
+  const run=async args=>{const result=await command(process.execPath,[cli,...args,'--home',home]);assert.equal(result.code,0,result.output);return result.output;};
+  await run(['init','--workspace','ws-test','--agent','agent-test','--signing-public-key',key,'--allow-autonomous','--endpoint',f.config.endpoint]);
+  const before=JSON.parse(await readFile(join(home,'config.json'),'utf8'));
+  assert.equal(before.signingKeyId,'runner-job-v1');assert.deepEqual(before.repos,[]);
+  await run(['pair','--credential','runner-abcdefghijkl.'+'a'.repeat(32)]);
+  const after=JSON.parse(await readFile(join(home,'config.json'),'utf8'));
+  assert.equal(after.signingPublicKey,before.signingPublicKey);assert.deepEqual(after.repos,[]);
+  const readiness=JSON.parse(await run(['diagnose']));
+  assert.equal(readiness.jobProtocolVersion,2);assert.deepEqual(readiness.repositories,[]);
+}));
+
+for (const kind of ['codex','claude']) test(`integration: ${kind} QA access denial stops before provider execution and criteria`,()=>fixture(kind,async f=>{
+  f.job.mode='review'; f.config.agentRole='qa'; f.signJob(); f.control.sourceDenied=true;
+  await assert.rejects(f.run(),/private-runner.*403/);
+  assert.equal(await exists(f.trace),false);
+  assert.equal(f.calls.find(c=>c.path==='/pulseRunnerComplete').body.failure.phase,'prepare-worktrees');
+  assert.equal(f.calls.some(c=>c.path.includes('submit_review')),false);
+}));

package/test/job.test.js

@@ -5,15 +5,30 @@ import { jobPayload, sanitize, validateJob } from '../src/job.js';
 
 test('accepts a signed, bound job and rejects changed identity', () => {
   const { publicKey, privateKey } = generateKeyPairSync('ed25519');
-  const job = { id: 'rjob-123', workspaceId: 'ws-1', issueId: 'issue-1', agentId: 'agent-1', runnerId: 'runner-123456789012', repoFullName: 'owner/repo', contextRepos: ['owner/repo', 'owner/app'], mode: 'task', issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 60_000).toISOString(), signatureAlgorithm: 'ed25519', signingKeyId: 'runner-job-v1' };
+  const job = { id: 'rjob-123', workspaceId: 'ws-1', projectId: 'project-1', protocolVersion: 2, issueId: 'issue-1', agentId: 'agent-1', runnerId: 'runner-123456789012', repoFullName: 'owner/repo', contextRepos: ['owner/repo', 'owner/app'], mode: 'task', issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 60_000).toISOString(), signatureAlgorithm: 'ed25519', signingKeyId: 'runner-job-v1' };
   job.signature = sign(null, Buffer.from(jobPayload(job)), privateKey).toString('base64url');
-  const config = { workspaceId: 'ws-1', agentId: 'agent-1', runnerId: 'runner-123456789012', repos: ['owner/repo', 'owner/app'], signingKeyId: 'runner-job-v1', signingPublicKey: publicKey.export({ type: 'spki', format: 'pem' }).toString() };
+  const config = { workspaceId: 'ws-1', agentId: 'agent-1', runnerId: 'runner-123456789012', repos: [], signingKeyId: 'runner-job-v1', signingPublicKey: publicKey.export({ type: 'spki', format: 'pem' }).toString() };
   assert.equal(validateJob(job, config), true);
   assert.throws(() => validateJob({ ...job, repoFullName: 'owner/other' }, config));
   assert.throws(() => validateJob({ ...job, contextRepos: ['owner/repo'] }, config));
 });
 test('sanitizes provider tokens', () => assert.equal(sanitize('Bearer secret.token sk-ant-secret'), 'Bearer [redacted] [redacted]'));
 
+test('upgraded Runner keeps the installed v1 key and accepts queued v1 jobs and signed project jobs', () => {
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+  const config = {workspaceId:'ws',runnerId:'runner',agentId:'dev',agentKind:'codex',repos:['owner/repo'],signingKeyId:'runner-job-v1',signingPublicKey:publicKey.export({type:'spki',format:'pem'}).toString()};
+  const legacy={id:'rjob-legacy',workspaceId:'ws',issueId:'issue',agentId:'dev',runnerId:'runner',repoFullName:'owner/repo',mode:'task',issuedAt:new Date().toISOString(),expiresAt:new Date(Date.now()+60000).toISOString(),signatureAlgorithm:'ed25519',signingKeyId:'runner-job-v1'};
+  // This is the exact deployed v1 payload, with no project/protocol fields.
+  const payload=[legacy.id,legacy.workspaceId,legacy.issueId,legacy.agentId,legacy.runnerId,legacy.repoFullName,legacy.repoFullName,legacy.mode,legacy.issuedAt,legacy.expiresAt,legacy.signatureAlgorithm,legacy.signingKeyId].join('.');
+  const old={...legacy,signature:sign(null,Buffer.from(payload),privateKey).toString('base64url')};
+  assert.equal(validateJob(old,config),true);
+  const project={...legacy,protocolVersion:2,projectId:'project',contextRepos:['owner/repo','owner/private']};
+  project.signature=sign(null,Buffer.from(jobPayload(project)),privateKey).toString('base64url');
+  assert.equal(validateJob(project,{...config,repos:[]}),true);
+  for(const mutation of [{projectId:'other'},{protocolVersion:undefined},{contextRepos:['owner/repo']},{projectId:undefined},{protocolVersion:3}]) assert.throws(()=>validateJob({...project,...mutation},config));
+  assert.throws(()=>validateJob(old,{...config,repos:[]}),/repository/);
+});
+
 test('signed QA jobs require explicit agent identity and provider/role compatibility', () => {
   const { publicKey, privateKey } = generateKeyPairSync('ed25519');
   const job = { id: 'rjob-qa', workspaceId: 'ws-1', issueId: 'issue-1', agentId: 'qa-1', runnerId: 'runner-1', repoFullName: 'owner/repo', mode: 'review', issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 60000).toISOString(), signatureAlgorithm: 'ed25519', signingKeyId: 'key' };

package/test/qa-source.test.js

@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { fileURLToPath } from 'node:url';
+import { command } from '../src/process.js';
+import { assertLocalReadiness } from '../src/readiness.js';
+
+test('QA source extractor preserves full files read-only and rejects unsafe archives before extraction', async () => {
+  const script = `
+import importlib.util,io,os,stat,tempfile,zipfile
+from pathlib import Path
+spec=importlib.util.spec_from_file_location('qa_source',os.environ['QA_SCRIPT'])
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+def archive(name,mode=0):
+    b=io.BytesIO()
+    with zipfile.ZipFile(b,'w') as z:
+        info=zipfile.ZipInfo(name);info.external_attr=mode<<16;z.writestr(info,'complete code')
+    return b.getvalue()
+with tempfile.TemporaryDirectory() as root:
+    target=Path(root)/'safe'
+    m.extract(archive('head/src/private.js'),target)
+    assert (target/'src/private.js').read_text()=='complete code'
+    assert (target/'src/private.js').stat().st_mode & 0o222 == 0
+    assert target.stat().st_mode & 0o222 == 0
+    for i,(name,mode) in enumerate([('head/../../escape',0),('/absolute',0),('head/.git/config',0),('head/link',stat.S_IFLNK|0o777),('head/device',stat.S_IFCHR|0o777)]):
+        invalid=Path(root)/str(i)
+        try:
+            m.extract(archive(name,mode),invalid)
+            raise AssertionError('unsafe archive accepted')
+        except RuntimeError:
+            assert not invalid.exists()
+    for path,dirs,files in os.walk(root):os.chmod(path,0o700)
+`;
+  const result = await command('python3', ['-c', script], { env: { ...process.env, PYTHONDONTWRITEBYTECODE: '1', QA_SCRIPT: fileURLToPath(new URL('../src/qa-source.py', import.meta.url)) } });
+  assert.equal(result.code, 0, result.output);
+});
+
+test('both local QA identities use provider readiness independently of global Git credentials', () => {
+  for (const kind of ['codex','claude']) {
+    const config = { identities: [{ agentId: kind, kind, role: 'qa' }] };
+    const job = { mode: 'review', agentId: kind, contextRepos: ['owner/private-runner'] };
+    const readiness = { providers: { [kind]: { cli: true, session: true } }, repositories: [{ repo: 'owner/private-runner', accessible: false }] };
+    assert.doesNotThrow(() => assertLocalReadiness(job, config, { kind, role: 'qa' }, readiness));
+    assert.throws(() => assertLocalReadiness({ ...job, mode: 'task' }, config, { kind, role: 'dev' }, readiness));
+  }
+});