@pulsehub/runner 0.1.6 → 0.1.8

package/README.md

@@ -85,3 +85,23 @@ pulse-runner profile remove --repo owner/repo
 ```
 
 Profiles are scoped by workspace and agent and saved locally with owner-only permissions. `--model` requires support in the installed provider CLI. Repository access probes run locally for the signed job context before checkout; no provider sessions are sent to Pulse.
+
+### QA de proyectos con repos privados
+
+QA requiere Python 3 además del CLI y su sesión local (Codex o Claude).
+Los snapshots completos se descargan por `pulseQaSource` con la key efímera
+del job; la identidad GitHub de lectura permanece en el backend y se revoca
+tras cada descarga. No se requiere login global de Git/gh ni permisos duplicados
+por agente. El proyecto actual determina todos los repos; un cambio desde el
+dispatch o un head cambiado obliga a repetir el run.
+
+El manifiesto `qa-sources.json` registra cada SHA exacto. Los snapshots son de
+sólo lectura, sin `.git`; el proveedor arranca en un directorio temporal fuera
+de los repos para evitar hooks/configuraciones del código revisado. QA no corre
+scripts, builds o tests locales con la sesión del proveedor presente. Un fallo
+al preparar repos se reporta como infraestructura antes de reclamar la revisión.
+
+Los ZIPs tienen un límite de 30 MiB comprimidos/256 MiB expandidos por repo;
+enlaces, archivos especiales y traversal se rechazan con diagnóstico visible.
+La limpieza y recuperación eliminan también snapshots interrumpidos de sólo
+lectura. Este protocolo requiere desplegar la versión compatible del backend.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsehub/runner",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Local, credential-safe Pulse Runner",
   "repository": {
     "type": "git",

package/src/process.js

@@ -95,20 +95,23 @@ export function providerInvocation(kind, worktree, additionalDirs, config, mcp,
 }
 
 export async function runAgent(kind, job, worktree, additionalWorktrees, config, credential, tempDir, options = {}) {
-  const context = additionalWorktrees.length
+  const reviewWorktrees = job.mode === 'review' ? [{ repo: job.repoFullName, worktree }, ...additionalWorktrees] : additionalWorktrees;
+  const context = reviewWorktrees.length
     ? job.mode === 'review'
-      ? ` Additional review worktrees for inspection: ${additionalWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}.`
-      : ` Additional writable project worktrees: ${additionalWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}. They are authorized for this same job: do not request a repository handoff. For every repository you change, create a pul/* branch in that worktree and commit the changes; the Runner will publish a PR for each changed branch.`
+      ? ` Snapshot manifest: ${join(worktree, '..', 'qa-sources.json')}. Additional review worktrees for inspection: ${reviewWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}.`
+      : ` Additional writable project worktrees: ${reviewWorktrees.map(({ repo, worktree: path }) => `${repo} (${path})`).join('; ')}. They are authorized for this same job: do not request a repository handoff. For every repository you change, create a pul/* branch in that worktree and commit the changes; the Runner will publish a PR for each changed branch.`
     : '';
   const prompt = job.mode === 'review'
-    ? `You are Pulse Runner performing a QA review for issue ${job.issueId}. First call pulse_next_review with identifier "${job.issueId}"; if found is false, stop without reviewing. Then call pulse_get_review_context with the same identifier. Review every pull request and its diff returned by that tool, along with the issue acceptance criteria and project Definition of Done. Use the provided local worktrees only to inspect files when a diff is too large or more context is needed. Do not modify files, commit, push, or create pull requests. Submit the evidence-based verdict with pulse_submit_review. If you cannot submit a verdict for any reason, call pulse_report_review_incomplete before ending. Do not print, persist, or transmit credentials.${context}`
+    ? `You are Pulse Runner performing a QA review for issue ${job.issueId}. First call pulse_next_review with identifier "${job.issueId}"; if found is false, stop without reviewing. Then call pulse_get_review_context with the same identifier. Review every pull request and its diff returned by that tool, along with the issue acceptance criteria and project Definition of Done. Use the provided local worktrees only to inspect files when a diff is too large or more context is needed. Snapshots are read-only and have no Git identity. Do not install dependencies or run build/tests/scripts from the reviewed code: provider sessions are present. Do not modify files, commit, push, or create pull requests. Submit the evidence-based verdict with pulse_submit_review. If you cannot submit a verdict for any reason, call pulse_report_review_incomplete before ending. Do not print, persist, or transmit credentials.${context}`
     : `You are Pulse Runner executing ${job.mode} for issue ${job.issueId}. Use the Pulse MCP server for issue context and reporting. Work only in the provided project worktrees. Do not print, persist, or transmit credentials.${context}`;
   const mcp = await mcpConfig(tempDir, credential, config.endpoint);
-  const additionalDirs = additionalWorktrees.flatMap(({ worktree: path }) => ['--add-dir', path]);
+  const additionalDirs = reviewWorktrees.flatMap(({ worktree: path }) => ['--add-dir', path]);
   try {
-    const invocation = providerInvocation(kind, worktree, additionalDirs, config, mcp, prompt, job.mode);
+    // Start QA outside every snapshot so repository CLI settings/hooks cannot run.
+    const agentDirectory = job.mode === 'review' ? tempDir : worktree;
+    const invocation = providerInvocation(kind, agentDirectory, additionalDirs, config, mcp, prompt, job.mode);
     if (options.profile?.model) invocation.args.splice(kind === 'codex' ? 1 : 0, 0, '--model', options.profile.model);
     const env = kind === 'codex' ? { ...process.env, PULSE_RUNNER_MCP_CREDENTIAL: `Bearer ${credential}` } : process.env;
-    return await command(invocation.executable, invocation.args, { cwd: worktree, env, signal: options.signal });
+    return await command(invocation.executable, invocation.args, { cwd: agentDirectory, env, signal: options.signal });
   } finally { await rm(mcp, { force: true }); }
 }

package/src/profile.js

@@ -27,7 +27,7 @@ export async function resolveProfile(config, job) {
   const profile = await agentProfile({ ...config, agentId: job.agentId });
   if (profile.model && !validModel(profile.model)) throw new Error('Configured model name is invalid.');
   if (profile.model && !(await supportsModelOption(config.agentKind))) throw new Error(`The installed ${config.agentKind} CLI does not support the --model option.`);
-  const directory = profile.directories?.[job.repoFullName];
+  const directory = job.mode === 'review' ? undefined : profile.directories?.[job.repoFullName];
   if (!directory) return { ...profile, directory: undefined };
   return { ...profile, directory: await validateLocalRepo(config, job.repoFullName, directory, job.contextRepos || [job.repoFullName]) };
 }

package/src/qa-source.py

@@ -0,0 +1,120 @@
+"""Trusted preparation, shared with the generated Actions workflow. No repo code runs."""
+import io
+import json
+import os
+from pathlib import Path, PurePosixPath
+import stat
+import sys
+import urllib.error
+import urllib.request
+import zipfile
+
+
+def call(body):
+    request = urllib.request.Request(os.environ['PULSE_QA_SOURCE_URL'],
+        data=json.dumps(body).encode(), headers={
+            'X-Pulse-QA-Credential': os.environ['PULSE_QA_CREDENTIAL'],
+            'Content-Type': 'application/json'})
+    try:
+        with urllib.request.urlopen(request, timeout=540) as response:
+            return response.read(30 * 1024 * 1024 + 1)
+    except urllib.error.HTTPError as error:
+        # Only structured infrastructure diagnostics; never echo headers or URLs.
+        try:
+            diagnostic = json.loads(error.read())
+            problems = diagnostic.get('problems') or [{'message': diagnostic.get('message', 'acceso denegado')}]
+            raise RuntimeError('; '.join((p.get('repo', '') + ': ' if p.get('repo') and not p['message'].startswith(p['repo']) else '') + p['message'] for p in problems)) from None
+        except (ValueError, KeyError):
+            raise RuntimeError('QA infrastructure HTTP %d' % error.code) from None
+
+
+def extract(data, target):
+    with zipfile.ZipFile(io.BytesIO(data)) as archive:
+        total = 0
+        entries = []
+        roots = set()
+        for entry in archive.infolist():
+            path = PurePosixPath(entry.filename)
+            mode = entry.external_attr >> 16
+            if path.is_absolute() or '..' in path.parts or '\\' in entry.filename:
+                raise RuntimeError('Snapshot con ruta insegura')
+            roots.add(path.parts[0])
+            if stat.S_ISLNK(mode) or (stat.S_IFMT(mode) not in (0, stat.S_IFREG, stat.S_IFDIR)):
+                raise RuntimeError('Snapshot con enlace o archivo especial')
+            if '.git' in path.parts:
+                raise RuntimeError('Snapshot con metadatos Git')
+            total += entry.file_size
+            if total > 256 * 1024 * 1024:
+                raise RuntimeError('Snapshot expandido supera 256 MiB')
+            entries.append((entry, path.parts[1:]))
+        if len(roots) != 1:
+            raise RuntimeError('Snapshot sin raíz única')
+        target.mkdir(parents=True)
+        for entry, parts in entries:
+            if not parts:
+                continue
+            dest = target.joinpath(*parts)
+            if entry.is_dir():
+                dest.mkdir(parents=True, exist_ok=True)
+            else:
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                with dest.open('xb') as output:
+                    output.write(archive.read(entry))
+                dest.chmod(0o444)
+        for directory in sorted((p for p in target.rglob('*') if p.is_dir()), reverse=True):
+            directory.chmod(0o555)
+        target.chmod(0o555)
+
+
+def main():
+    identifier = os.environ['PULSE_QA_IDENTIFIER']
+    root = Path(os.environ['PULSE_QA_ROOT'])
+    manifest = json.loads(call({'identifier': identifier}))
+    expected = json.loads(os.environ.get('PULSE_QA_EXPECTED_REPOS', 'null'))
+    if expected is not None and sorted(expected) != sorted(r['repo'] for r in manifest['repositories']):
+        raise RuntimeError('El proyecto cambió desde el dispatch; repetí el run')
+    primary = os.environ.get('PULSE_QA_PRIMARY_REPO')
+    primary_snapshot = next((r for r in manifest['repositories'] if r['repo'] == primary), None)
+    if os.environ.get('PULSE_QA_MANIFEST_ONLY') == '1':
+        if not primary_snapshot:
+            raise RuntimeError('Repositorio anfitrión fuera del proyecto')
+        with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+            output.write('head_sha=' + primary_snapshot['sha'] + '\n')
+        return
+    expected_head = os.environ.get('PULSE_QA_EXPECTED_PRIMARY_SHA')
+    if expected_head and (not primary_snapshot or primary_snapshot['sha'] != expected_head):
+        raise RuntimeError('El head cambió desde verify; repetí el run')
+    for snapshot in manifest['repositories']:
+        repo = snapshot['repo']
+        parts = repo.split('/')
+        if len(parts) != 2 or any(not part or any(c not in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.-' for c in part) for part in parts):
+            raise RuntimeError('Repositorio inválido en snapshot')
+        archive = call({'identifier': identifier, 'repo': repo, 'sha': snapshot['sha']})
+        extract(archive, root / repo.replace('/', '__'))
+    root.mkdir(parents=True, exist_ok=True)
+    (root / 'qa-sources.json').write_text(json.dumps(manifest))
+    print('QA sources ready.')
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except Exception as error:
+        # Infrastructure is reported before claiming/evaluating a review.
+        try:
+            body = {'jsonrpc': '2.0', 'id': 1, 'method': 'tools/call', 'params': {'name': 'pulse_comment_issue', 'arguments': {'identifier': os.environ['PULSE_QA_IDENTIFIER'], 'body': 'QA no arrancó: fallo de infraestructura al preparar repositorios. ' + str(error)}}}
+            request = urllib.request.Request(os.environ['PULSE_QA_SOURCE_URL'].replace('/pulseQaSource', '/pulseMcp'), data=json.dumps(body).encode(), headers={'Authorization': 'Bearer ' + os.environ['PULSE_QA_CREDENTIAL'], 'Content-Type': 'application/json', 'Accept': 'application/json, text/event-stream'})
+            with urllib.request.urlopen(request, timeout=30):
+                pass
+        except Exception:
+            pass
+        if os.environ.get('PULSE_QA_RUN_ID'):
+            try:
+                body = {'jsonrpc': '2.0', 'id': 2, 'method': 'tools/call', 'params': {'name': 'pulse_report_run', 'arguments': {'runId': os.environ['PULSE_QA_RUN_ID'], 'outcome': 'failed'}}}
+                request = urllib.request.Request(os.environ['PULSE_QA_SOURCE_URL'].replace('/pulseQaSource', '/pulseMcp'), data=json.dumps(body).encode(), headers={'Authorization': 'Bearer ' + os.environ['PULSE_QA_CREDENTIAL'], 'Content-Type': 'application/json', 'Accept': 'application/json, text/event-stream'})
+                with urllib.request.urlopen(request, timeout=30):
+                    pass
+            except Exception:
+                pass
+        print('QA infrastructure: ' + str(error), file=sys.stderr)
+        sys.exit(1)

package/src/readiness.js

@@ -23,7 +23,7 @@ export async function inspectReadiness(config, run = command) {
     const accessible = await run('git', ['ls-remote', '--exit-code', `https://github.com/${repo}.git`, 'HEAD'], { env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, timeout: 10_000, maxOutput: 4096 }).then((result) => result.code === 0).catch(() => false);
     repositories.push({ repo, accessible });
   }
-  return { workspaceId: config.workspaceId, identities: localIdentities(config), providers, repositories, jobProtocolVersion: 2 };
+  return { workspaceId: config.workspaceId, identities: localIdentities(config), providers, repositories, jobProtocolVersion: 2, qaSourceProtocolVersion: 1 };
 }
 
 export function assertLocalReadiness(job, config, agent, readiness) {
@@ -31,5 +31,5 @@ export function assertLocalReadiness(job, config, agent, readiness) {
   const role = job.mode === 'review' ? 'qa' : 'dev';
   if (!identity || identity.kind !== agent.kind || identity.role !== role || agent.role !== role) throw new Error('Local agent identity/provider/role mismatch. Run pulse-runner identity add with this agent configuration.');
   if (!readiness.providers[agent.kind]?.cli || !readiness.providers[agent.kind]?.session) throw new Error(`Local ${agent.kind} CLI/session is unavailable. Sign in locally and run pulse-runner diagnose.`);
-  if ((job.contextRepos || [job.repoFullName]).some((repo) => !readiness.repositories.some((entry) => entry.repo === repo && entry.accessible))) throw new Error('Local repository access is unavailable. Check Git authentication and run pulse-runner diagnose.');
+  if (job.mode !== 'review' && (job.contextRepos || [job.repoFullName]).some((repo) => !readiness.repositories.some((entry) => entry.repo === repo && entry.accessible))) throw new Error('Local repository access is unavailable. Check Git authentication and run pulse-runner diagnose.');
 }

package/src/runtime.js

@@ -1,4 +1,5 @@
 import { appendFile, chmod, mkdir, open, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
 import { join } from 'node:path';
 import { ensureDataDir, paths, readCredential, readProfiles, removeTemporary } from './config.js';
 import { validateJob, sanitize } from './job.js';
@@ -61,6 +62,7 @@ async function checkoutRepo(repo, worktree, signal, sourceDirectory) {
   return addIsolatedWorktree(repo, mirror, worktree, { signal });
 }
 async function checkout(job, options = {}) {
+  if (job.mode === 'review') return checkoutQa(job, options);
   const root = join(paths().worktrees, job.id); const repos = [...new Set(job.contextRepos || [job.repoFullName])]; const checkouts = [];
   await mkdir(root, { recursive: true, mode: 0o700 });
   try {
@@ -74,13 +76,35 @@ async function checkout(job, options = {}) {
     return { primary, checkouts };
   } catch (error) { await cleanup(checkouts); await removeTemporary(root); throw error; }
 }
+export async function checkoutQa(job, options = {}) {
+  const root = join(paths().worktrees, job.id);
+  const result = await command('python3', [fileURLToPath(new URL('./qa-source.py', import.meta.url))], {
+    signal: options.signal, timeout: 540_000,
+    env: { ...process.env, PULSE_QA_SOURCE_URL: options.config.endpoint.replace(/\/$/, '') + '/pulseQaSource',
+      PULSE_QA_CREDENTIAL: options.credential, PULSE_QA_IDENTIFIER: job.issueId, PULSE_QA_ROOT: root,
+      PULSE_QA_EXPECTED_REPOS: JSON.stringify(job.contextRepos || [job.repoFullName]) },
+  });
+  if (result.code !== 0) { await makeWritable(root).catch(() => {}); await removeTemporary(root); throw new Error(sanitize(result.output)); }
+  const manifest = JSON.parse(await readFile(join(root, 'qa-sources.json'), 'utf8'));
+  const checkouts = manifest.repositories.map(({ repo, sha }) => ({ repo, worktree: join(root, repoPath(repo)), baseCommit: sha, snapshot: true }));
+  const primary = checkouts.find((entry) => entry.repo === job.repoFullName);
+  if (!primary) throw new Error('QA snapshot target is missing.');
+  return { primary, checkouts };
+}
+async function makeWritable(path) {
+  await chmod(path, 0o700);
+  for (const entry of await readdir(path, { withFileTypes: true })) if (entry.isDirectory()) await makeWritable(join(path, entry.name));
+}
 async function cleanup(checkouts) {
-  await Promise.all(checkouts.map(async ({ worktree, mirror, sourceDirectory }) => {
+  await Promise.all(checkouts.map(async ({ worktree, mirror, sourceDirectory, snapshot }) => {
+    if (snapshot) {
+      await makeWritable(worktree); await removeTemporary(worktree); return;
+    }
     await removeIsolatedWorktree({ mirror, worktree, sourceDirectory });
     await removeTemporary(worktree);
   }));
 }
-async function publishCheckout(checkout, jobId, checkActive, signal) {
+async function publishCheckout(checkout, jobId, issueId, checkActive, signal) {
   const branchResult = await command('git', ['-C', checkout.worktree, 'branch', '--show-current'], { signal });
   const branch = branchResult.output.trim();
   if (!branch || !branch.startsWith('pul/')) {
@@ -98,6 +122,9 @@ async function publishCheckout(checkout, jobId, checkActive, signal) {
     await logEvent('publication.skipped', { jobId, repo: checkout.repo, branch, reason: 'no-commits' });
     return '';
   }
+  const subject = await command('git', ['-C', checkout.worktree, 'log', '-1', '--format=%s'], { signal });
+  if (subject.code !== 0) throw Object.assign(new Error(sanitize(subject.output)), { phase });
+  const pullRequestTitle = sanitize(subject.output.trim().replace(/\s+/g, ' ')).slice(0, 120) || 'Pulse Runner update';
   // Sólo se publica una rama de trabajo Pulse de un worktree firmado como
   // contexto de este job. El Runner no elige repos ni destinos externos.
   phase = 'push';
@@ -115,16 +142,17 @@ async function publishCheckout(checkout, jobId, checkActive, signal) {
   if (!/no pull requests found/i.test(existing.output)) throw Object.assign(new Error(sanitize(existing.output)), { phase });
   phase = 'create-pull-request';
   await checkActive();
-  const created = await command(resolveExecutable('gh'), ['pr', 'create', '--repo', checkout.repo, '--base', 'main', '--head', branch, '--fill'], { signal, timeout: 30_000 });
+  const pullRequestBody = `Automated changes from Pulse Runner for issue ${sanitize(issueId)}.`;
+  const created = await command(resolveExecutable('gh'), ['pr', 'create', '--repo', checkout.repo, '--base', 'main', '--head', branch, '--title', pullRequestTitle, '--body', pullRequestBody], { signal, timeout: 30_000 });
   if (created.code !== 0) throw Object.assign(new Error(sanitize(created.output)), { phase });
   await logEvent('publication.pull-request-created', { jobId, repo: checkout.repo, branch, url: created.output.trim() });
   return `Published ${checkout.repo}:${branch}; ${created.output.trim()}`;
 }
-async function publish(checkouts, jobId, checkActive, signal) {
+async function publish(checkouts, jobId, issueId, checkActive, signal) {
   const publications = { succeeded: [], failed: [] };
   for (const checkout of checkouts) {
     try {
-      const published = await publishCheckout(checkout, jobId, checkActive, signal);
+      const published = await publishCheckout(checkout, jobId, issueId, checkActive, signal);
       if (published) publications.succeeded.push(published);
     } catch (error) {
       if (error.name === 'AbortError') throw error;
@@ -200,7 +228,7 @@ export async function runOnce(config, options = {}) {
     jobPhase = 'prepare-worktrees';
     await writeFile(journal, JSON.stringify({ jobId: job.id }), { mode: 0o600 });
     await chmod(journal, 0o600);
-    const { primary, checkouts } = await prepare(job, { signal: controller.signal, profile });
+    const { primary, checkouts } = await prepare(job, { signal: controller.signal, profile, config, credential: delivery.mcpCredential });
     const temp = join(paths().root, 'tmp', job.id);
     let completion;
     try {
@@ -212,7 +240,7 @@ export async function runOnce(config, options = {}) {
       await checkActive();
       await logEvent(result.code === 0 ? 'agent.completed' : 'agent.failed', { jobId: job.id, exitCode: result.code, ...(result.code === 0 ? {} : { error: failureDetail(result.output) }) });
       jobPhase = 'publication';
-      const publication = result.code === 0 && job.mode !== 'review' ? await publishWork(checkouts, job.id, checkActive, controller.signal) : { succeeded: [], failed: [] };
+      const publication = result.code === 0 && job.mode !== 'review' ? await publishWork(checkouts, job.id, job.issueId, checkActive, controller.signal) : { succeeded: [], failed: [] };
       await checkActive();
       const outcome = result.code === 0 && publication.failed.length === 0 ? 'completed' : 'failed';
       const failure = outcome === 'failed' ? { phase: result.code !== 0 ? 'run-agent' : publication.failed[0]?.phase || 'publication', category: 'execution', correlationId: job.id } : null;
@@ -253,7 +281,7 @@ export async function recoverInterruptedWork(config) {
   for (const area of [p.worktrees, join(p.root, 'tmp')]) {
     await mkdir(area, { recursive: true, mode: 0o700 });
     const jobs = await readdir(area, { withFileTypes: true });
-    await Promise.all(jobs.map((entry) => rm(join(area, entry.name), { recursive: true, force: true })));
+    await Promise.all(jobs.map(async (entry) => { if (entry.isDirectory()) await makeWritable(join(area, entry.name)); await rm(join(area, entry.name), { recursive: true, force: true }); }));
   }
   const repositories = await readdir(p.repos, { withFileTypes: true });
   await Promise.all(repositories.filter((entry) => entry.isDirectory()).map((entry) => command('git', ['--git-dir', join(p.repos, entry.name), 'worktree', 'prune']).catch(() => {})));

package/test/integration.test.js

@@ -36,7 +36,7 @@ else {
   const file = args[args.indexOf('--mcp-config') + 1];
   const received = args.includes('exec') ? !!process.env.PULSE_RUNNER_MCP_CREDENTIAL?.startsWith('Bearer ') : !!JSON.parse(readFileSync(file)).mcpServers.pulse.headers.Authorization;
   const child = settings.slow ? spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], {stdio:'ignore'}) : null;
-  writeFileSync(${JSON.stringify(trace)}, JSON.stringify({args, received, pid: process.pid, childPid: child?.pid}));
+  writeFileSync(${JSON.stringify(trace)}, JSON.stringify({args, received, cwd: process.cwd(), pid: process.pid, childPid: child?.pid}));
   writeFileSync('job-output.txt', 'isolated output');
   if (settings.publish) {
     for (const argv of [['switch','-c','pul/fixture'],['add','job-output.txt'],['-c','user.name=Fixture','-c','user.email=fixture@example.invalid','commit','-m','fixture job']]) {
@@ -75,11 +75,19 @@ else console.log('https://github.com/owner/repo/pull/123');
   signJob();
   const calls = [];
   const control = { cancel: false, cancelWhenRunning: false, disconnectWhenRunning: false };
+  const zipResult = await command('python3', ['-c', "import io,zipfile,base64; b=io.BytesIO(); z=zipfile.ZipFile(b,'w'); z.writestr('snapshot/source.txt','QA fixture'); z.close(); print(base64.b64encode(b.getvalue()).decode())"]);
+  assert.equal(zipResult.code, 0);
+  const archive = Buffer.from(zipResult.output.trim(), 'base64');
   const server = createServer(async (req, res) => {
     let raw = ''; for await (const chunk of req) raw += chunk;
     const body = JSON.parse(raw); calls.push({path:req.url, body});
     res.setHeader('Content-Type', 'application/json');
-    if (req.url === '/pulseRunnerPoll') res.end(JSON.stringify({job, agent:{kind,role: job.mode === 'review' ? 'qa' : 'dev'}, mcpCredential:'pulse_sk_fixture'}));
+    if (req.url === '/pulseQaSource') {
+      if (control.sourceDenied) { res.statusCode=409; res.end(JSON.stringify({problems:[{repo:'owner/private-runner',message:'owner/private-runner: HTTP 403'}]})); }
+      else if (body.repo) { res.setHeader('Content-Type','application/zip'); res.end(archive); }
+      else res.end(JSON.stringify({projectId:'project-fixture',repositories:(job.contextRepos || [job.repoFullName]).map(repo=>({repo,sha:'a'.repeat(40)}))}));
+    }
+    else if (req.url === '/pulseRunnerPoll') res.end(JSON.stringify({job, agent:{kind,role: job.mode === 'review' ? 'qa' : 'dev'}, mcpCredential:'pulse_sk_fixture'}));
     else if (body.jobId && req.url === '/pulseRunnerHeartbeat') {
       const running = await exists(trace);
       if (control.disconnectWhenRunning && running) {res.statusCode=401;res.end('{}');}
@@ -235,13 +243,16 @@ test('integration: a job expires during execution and is stopped before publicat
   assert.equal(await exists(join(paths().worktrees,f.job.id)),false);
 }));
 
-test('integration: QA execution retains read-only flags and never publishes',()=>fixture('codex',async f=>{
-  f.job.mode='review'; f.signJob();
+for (const kind of ['codex','claude']) test(`integration: ${kind} QA reads all project snapshots without global Git auth and never publishes`,()=>fixture(kind,async f=>{
+  f.job.mode='review'; f.job.contextRepos=['owner/repo','owner/app','owner/private-runner']; f.config.repos=f.job.contextRepos; f.signJob();
   f.config.agentRole='qa';
   let published=false;
   await f.run({publish:async()=>{published=true;}});
   const trace=JSON.parse(await readFile(f.trace,'utf8'));
-  assert.ok(trace.args.includes('read-only'));
+  assert.ok(trace.args.includes(kind==='codex' ? 'read-only' : 'plan'));
+  assert.match(trace.args.at(-1), /owner\/private-runner/);
+  assert.match(trace.cwd.replaceAll('\\','/'),new RegExp(`/runner/tmp/${f.job.id}$`,'i'));
+  assert.equal(f.calls.filter(c=>c.path==='/pulseQaSource' && c.body.repo).length,3);
   assert.equal(published,false);
   assert.equal(f.calls.find(c=>c.path==='/pulseRunnerComplete').body.outcome,'completed');
 }));
@@ -323,3 +334,11 @@ test('integration: CLI init, pairing and diagnose need no per-agent repo configu
   const readiness=JSON.parse(await run(['diagnose']));
   assert.equal(readiness.jobProtocolVersion,2);assert.deepEqual(readiness.repositories,[]);
 }));
+
+for (const kind of ['codex','claude']) test(`integration: ${kind} QA access denial stops before provider execution and criteria`,()=>fixture(kind,async f=>{
+  f.job.mode='review'; f.config.agentRole='qa'; f.signJob(); f.control.sourceDenied=true;
+  await assert.rejects(f.run(),/private-runner.*403/);
+  assert.equal(await exists(f.trace),false);
+  assert.equal(f.calls.find(c=>c.path==='/pulseRunnerComplete').body.failure.phase,'prepare-worktrees');
+  assert.equal(f.calls.some(c=>c.path.includes('submit_review')),false);
+}));

package/test/qa-source.test.js

@@ -0,0 +1,70 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { fileURLToPath } from 'node:url';
+import { command } from '../src/process.js';
+import { assertLocalReadiness } from '../src/readiness.js';
+
+test('QA source extractor preserves full files read-only and rejects unsafe archives before extraction', async () => {
+  const script = `
+import importlib.util,io,os,stat,tempfile,zipfile
+from pathlib import Path
+spec=importlib.util.spec_from_file_location('qa_source',os.environ['QA_SCRIPT'])
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+def archive(name,mode=0):
+    b=io.BytesIO()
+    with zipfile.ZipFile(b,'w') as z:
+        info=zipfile.ZipInfo(name);info.external_attr=mode<<16;z.writestr(info,'complete code')
+    return b.getvalue()
+with tempfile.TemporaryDirectory() as root:
+    target=Path(root)/'safe'
+    m.extract(archive('head/src/private.js'),target)
+    assert (target/'src/private.js').read_text()=='complete code'
+    assert (target/'src/private.js').stat().st_mode & 0o222 == 0
+    assert target.stat().st_mode & 0o222 == 0
+    for i,(name,mode) in enumerate([('head/../../escape',0),('/absolute',0),('head/.git/config',0),('head/link',stat.S_IFLNK|0o777),('head/device',stat.S_IFCHR|0o777)]):
+        invalid=Path(root)/str(i)
+        try:
+            m.extract(archive(name,mode),invalid)
+            raise AssertionError('unsafe archive accepted')
+        except RuntimeError:
+            assert not invalid.exists()
+    for path,dirs,files in os.walk(root):os.chmod(path,0o700)
+`;
+  const result = await command('python3', ['-c', script], { env: { ...process.env, PYTHONDONTWRITEBYTECODE: '1', QA_SCRIPT: fileURLToPath(new URL('../src/qa-source.py', import.meta.url)) } });
+  assert.equal(result.code, 0, result.output);
+});
+
+test('Runner sends its QA application credential outside the Authorization header', async () => {
+  const script = `
+import importlib.util,os
+from pathlib import Path
+spec=importlib.util.spec_from_file_location('qa_source',os.environ['QA_SCRIPT'])
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+seen=[]
+class Response:
+    def __enter__(self): return self
+    def __exit__(self,*args): pass
+    def read(self,size): return b'{}'
+def fake(request,timeout):
+    seen.append({k.lower():v for k,v in request.header_items()})
+    return Response()
+m.urllib.request.urlopen=fake
+os.environ['PULSE_QA_SOURCE_URL']='https://example.invalid/pulseQaSource'
+os.environ['PULSE_QA_CREDENTIAL']='fixture-only'
+m.call({'identifier':'TES-fixture'})
+assert seen[0]['x-pulse-qa-credential']=='fixture-only'
+assert 'authorization' not in seen[0]
+`;
+  const result = await command('python3', ['-c', script], { env: { ...process.env, PYTHONDONTWRITEBYTECODE: '1', QA_SCRIPT: fileURLToPath(new URL('../src/qa-source.py', import.meta.url)) } });
+  assert.equal(result.code, 0, result.output);
+});
+
+test('both local QA identities use provider readiness independently of global Git credentials', () => {
+  for (const kind of ['codex','claude']) {
+    const config = { identities: [{ agentId: kind, kind, role: 'qa' }] };
+    const job = { mode: 'review', agentId: kind, contextRepos: ['owner/private-runner'] };
+    const readiness = { providers: { [kind]: { cli: true, session: true } }, repositories: [{ repo: 'owner/private-runner', accessible: false }] };
+    assert.doesNotThrow(() => assertLocalReadiness(job, config, { kind, role: 'qa' }, readiness));
+    assert.throws(() => assertLocalReadiness({ ...job, mode: 'task' }, config, { kind, role: 'dev' }, readiness));
+  }
+});