mtech-ai-local-runner 0.1.111 → 0.1.113

package/dist/src/asks/doctor.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { connect } from "node:net";
-import { claudeModStatusOf, statusOf } from "./commands.js";
+import { statusOf } from "./commands.js";
 import { hubSocketPath } from "./hub.js";
 import { MAX_LINE_BYTES, encodeLine } from "./hub-protocol.js";
 import { CLAUDE_PLUGIN_NAME } from "./integrations.js";
@@ -93,9 +93,8 @@ export async function asksDoctorReport(input) {
     const [status, statuses] = await Promise.all([hubStatus(input.stateRoot), Promise.all(APPS.map(app => statusOf(app, input.env, input.stateRoot)))]);
     const integrations = [];
     for (const report of statuses) {
-        const mod = report.app === "claude" ? { mod: await claudeModStatusOf(input.env, input.stateRoot) } : {};
         if (report.state !== "installed") {
-            integrations.push({ ...report, ...mod });
+            integrations.push(report);
             continue;
         }
         if (report.app === "codex") {
@@ -103,7 +102,7 @@ export async function asksDoctorReport(input) {
             continue;
         }
         const loaded = await claudePluginLoaded(input.env, input.run);
-        integrations.push({ ...report, ...mod, ...(loaded === null ? {} : { loaded }), ...(loaded === false ? { action: CLAUDE_NOT_LOADED } : {}) });
+        integrations.push({ ...report, ...(loaded === null ? {} : { loaded }), ...(loaded === false ? { action: CLAUDE_NOT_LOADED } : {}) });
     }
     return { mode: input.mode, hub: status === null ? { status: "not_running" } : { status: "running", ...status }, integrations };
 }

package/dist/src/cli.js

@@ -36,7 +36,7 @@ import { access, mkdir, rm } from "node:fs/promises";
 import { buildMessengerDaemon } from "./asks/messenger.js";
 import { removeMenubarInstall, runMenubarCommand, setupMenubarApp } from "./menubar/commands.js";
 import { runHookClient } from "./asks/hook-client.js";
-import { installGuideIntegrations, installIntegrations, parseFeatures, parseSetupIntegrations, removeAsksInstall, removeGuideInstall, runIntegrationsCommand, setupClaudeMod } from "./asks/commands.js";
+import { installGuideIntegrations, installIntegrations, parseFeatures, parseSetupIntegrations, removeAsksInstall, removeGuideInstall, retireWorkRoomPane, runIntegrationsCommand } from "./asks/commands.js";
 import { asksDoctorReport } from "./asks/doctor.js";
 import { guideDoctorReport, guideReportShown } from "./guide/doctor.js";
 import { runClaudeReleaseCommand } from "./commands/claude-release.js";
@@ -316,8 +316,8 @@ export async function main(argv, env, io = {}) {
                 const features = requestedFeatures ?? ["asks"];
                 const integrations = features.includes("asks") ? await installIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : [];
                 const guide = features.includes("guide") ? await installGuideIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : undefined;
-                // The Work Room pane goes with every setup (owner decision 2026-10-31); --integrations claude has just installed it.
-                const workRoomPane = integrations.some(report => report.app === "claude" && report.mod !== undefined) ? undefined : await setupClaudeMod(env, config.stateRoot);
+                // The Work Room pane mod is retired (owner decision 2026-11-12): every setup removes the copy an older runner installed.
+                const workRoomPane = await retireWorkRoomPane(env, config.stateRoot) ?? undefined;
                 // The menu bar app (Work Item b9218937) goes with every setup unless the person removed it.
                 const menubar = await setupMenubarApp(env, config.stateRoot);
                 // The LaunchAgent runs a copy under releases/<version>, never the npx cache that may have run setup.

package/dist/src/daemon/codex-app-host-entry.js

@@ -0,0 +1,94 @@
+import { randomUUID } from "node:crypto";
+import { connectCodexAppSetup } from "./codex-app-tools-host.js";
+const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const blocked = () => ({ status: "blocked", creationBlocked: true, gatewayWritesBlocked: true });
+/**
+ * One ephemeral, read-only callback invocation across the supported Node REPL/app tools.
+ * No network listener, durable inbox, execution aggregate, credentials or live-mode option.
+ * The authenticated supervisor dispatches only the returned exact official read call, then
+ * supplies its raw MCP response. Correlation IDs identify RPCs, never app/Work Sessions.
+ */
+export class CodexAppHostReadOnlyEntry {
+    connection;
+    scope;
+    started = false;
+    closed = false;
+    result;
+    waiting;
+    constructor(scope) {
+        this.scope = { ...scope };
+        const deny = async () => { throw new Error("Creation and Gateway writes are blocked in read-only host entry"); };
+        this.connection = connectCodexAppSetup({ approvedHostId: scope.hostId, approvedProjectId: scope.projectId,
+            tools: {
+                listProjects: args => this.request({ id: randomUUID(), tool: "list_projects", arguments: args }),
+                readThread: args => this.request({ id: randomUUID(), tool: "read_thread", arguments: args }),
+                createThread: deny,
+            }, claimDispatch: deny, report: deny });
+    }
+    start(input) {
+        if (this.started || this.closed)
+            throw new Error("Probe is single-use");
+        if (!object(input) || Object.keys(input).some(k => k !== "threadId") || (input.threadId !== undefined
+            && (typeof input.threadId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(input.threadId))))
+            throw new Error("Exact existing thread ID or empty discovery input required");
+        const threadId = input.threadId;
+        this.started = true;
+        void this.probe(threadId).then(result => { if (!this.closed)
+            this.result = result; }, () => { if (!this.closed)
+            this.result = blocked(); });
+    }
+    async next() {
+        // Flush the local promise chain only; never waits for an external tool or polls a server.
+        await new Promise(resolve => setImmediate(resolve));
+        if (this.result)
+            return { kind: "done", result: { ...this.result } };
+        if (!this.waiting)
+            return { kind: this.started ? "awaiting_reply" : "idle" };
+        if (this.waiting.delivered)
+            return { kind: "awaiting_reply" };
+        this.waiting.delivered = true;
+        return { kind: "tool_call", call: structuredClone(this.waiting.call) };
+    }
+    reply(id, response) {
+        const pending = this.waiting;
+        if (this.closed || !pending?.delivered || pending.call.id !== id)
+            throw new Error("No matching outstanding official call");
+        this.waiting = undefined;
+        pending.resolve(response);
+    }
+    close() {
+        this.closed = true;
+        this.result = blocked();
+        const pending = this.waiting;
+        this.waiting = undefined;
+        pending?.reject(new Error("Host probe closed"));
+    }
+    /** No caller-controlled flag, receipt or copied approval can enable side effects here. */
+    execute(_input) { return { status: "creation_blocked" }; }
+    /** Local fixtures only: exercise the original adapter up to its denied write boundary. */
+    startAdapterCheck(input) {
+        if (this.started || this.closed)
+            throw new Error("Probe is single-use");
+        this.started = true;
+        void this.connection.adapter.execute(input).then(result => {
+            if (!this.closed)
+                this.result = { ...blocked(), adapterStatus: result.status };
+        }, () => { if (!this.closed)
+            this.result = blocked(); });
+    }
+    request(call) {
+        if (this.closed || this.waiting)
+            return Promise.reject(new Error("Probe cannot issue another call"));
+        return new Promise((resolve, reject) => { this.waiting = { call, delivered: false, resolve, reject }; });
+    }
+    async probe(threadId) {
+        const projects = await this.connection.host.listProjects();
+        if (!projects.some(p => p.hostId === this.scope.hostId && p.projectId === this.scope.projectId))
+            return blocked();
+        if (!threadId)
+            return { status: "connected_read_only", creationBlocked: true, gatewayWritesBlocked: true };
+        const observation = await this.connection.host.track({ threadId });
+        const verified = observation.status === "identity_observed";
+        return { ...blocked(), status: verified ? "connected_read_only" : "blocked", identity: verified ? "identity_observed" : "unverified" };
+    }
+}

package/dist/src/daemon/codex-app-setup.js

@@ -0,0 +1,125 @@
+import { createHash } from "node:crypto";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const text = (value) => typeof value === "string" && value.trim().length > 0;
+const only = (value, allowed) => Object.keys(value).every(key => allowed.includes(key));
+/**
+ * Consumes a fresh Gateway prepare receipt, never creates its own authority or binds a recipient.
+ * Gateway atomically grants a one-use dispatch claim before the external side effect. The local
+ * fence additionally blocks duplicate calls on this adapter, including lost claim acknowledgements.
+ * No concrete native endpoint is wired here. A caller must supply the supported authenticated host.
+ */
+export class CodexAppSetupAdapter {
+    deps;
+    attempted = new Set();
+    hostId;
+    projectId;
+    constructor(deps) {
+        this.deps = deps;
+        if (!text(deps.approvedHostId) || !text(deps.approvedProjectId))
+            throw new Error("Explicit approved host and project required");
+        this.hostId = deps.approvedHostId;
+        this.projectId = deps.approvedProjectId;
+    }
+    async execute(input) {
+        if (!this.validReceipt(input))
+            return { status: "rejected" };
+        if (!input.can_create || this.attempted.has(input.intent_id))
+            return { status: "skipped" };
+        if (input.setup_outcome !== "reserved" || input.target_ref !== null || input.authority_failure !== null
+            || input.thread_id !== undefined || input.pending_handle !== undefined || input.client_link_id !== undefined)
+            return { status: "rejected" };
+        const args = this.createArguments(input.create_thread);
+        if (!args || createHash("sha256").update(args.prompt, "utf8").digest("hex") !== input.setup_prompt_sha256)
+            return { status: "rejected" };
+        const intentId = input.intent_id;
+        const expiresAt = input.expires_at;
+        const setupPromptSha256 = input.setup_prompt_sha256;
+        // Fence before any await. A discovery failure cannot cause an accidental concurrent retry.
+        this.attempted.add(intentId);
+        try {
+            const projects = await this.deps.host.listProjects();
+            if (!Array.isArray(projects) || !projects.some(project => record(project)
+                && project.projectId === this.projectId && project.hostId === this.hostId))
+                return { status: "rejected" };
+        }
+        catch {
+            return { status: "rejected" };
+        }
+        if (expiresAt <= Date.now() / 1000)
+            return { status: "rejected" };
+        let claim;
+        try {
+            claim = await this.deps.claimDispatch({ intent_id: intentId, host_id: this.hostId, project_id: this.projectId, outcome: "dispatch" });
+        }
+        catch {
+            return { status: "uncertain", reportRecorded: false };
+        }
+        if (!this.validReceipt(claim) || claim.intent_id !== intentId)
+            return { status: "uncertain", reportRecorded: false };
+        if (!claim.can_create)
+            return { status: "skipped" };
+        if (claim.setup_prompt_sha256 !== setupPromptSha256 || createHash("sha256").update(args.prompt, "utf8").digest("hex") !== claim.setup_prompt_sha256
+            || claim.setup_outcome !== "dispatching" || claim.target_ref !== null || claim.authority_failure !== null
+            || claim.thread_id !== undefined || claim.pending_handle !== undefined || claim.client_link_id !== undefined
+            || expiresAt <= Date.now() / 1000)
+            return { status: "uncertain", reportRecorded: false };
+        const report = { intent_id: intentId, host_id: this.hostId, project_id: this.projectId, outcome: "uncertain" };
+        try {
+            const result = await this.deps.host.createThread(args);
+            if (record(result)) {
+                if (text(result.threadId) && UUID.test(result.threadId) && result.hostId === this.hostId && result.clientThreadId === undefined) {
+                    report.outcome = "created";
+                    report.thread_id = result.threadId;
+                }
+                else if (text(result.clientThreadId) && result.threadId === undefined
+                    && (result.hostId === undefined || result.hostId === this.hostId)) {
+                    report.outcome = "pending";
+                    report.pending_handle = result.clientThreadId;
+                }
+            }
+        }
+        catch {
+            // The host may have created the thread before losing its acknowledgement. Never replay.
+        }
+        try {
+            await this.deps.report(report);
+            return { status: report.outcome, reportRecorded: true };
+        }
+        catch {
+            // Even a successful host response is not reconciled when Gateway's acknowledgement is lost.
+            return { status: "uncertain", reportRecorded: false };
+        }
+    }
+    validReceipt(input) {
+        if (!record(input) || !only(input, ["intent_id", "host_id", "project_id", "can_create", "create_thread", "setup_outcome", "target_ref", "grants_execution", "expires_at", "authority_failure", "thread_id", "pending_handle", "client_link_id", "setup_prompt_sha256"])
+            || !text(input.intent_id) || !UUID.test(input.intent_id) || input.host_id !== this.hostId || input.project_id !== this.projectId
+            || typeof input.setup_prompt_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(input.setup_prompt_sha256)
+            || typeof input.can_create !== "boolean" || input.grants_execution !== false
+            || typeof input.expires_at !== "number" || !Number.isSafeInteger(input.expires_at) || input.expires_at <= Date.now() / 1000
+            || (input.authority_failure !== null && !text(input.authority_failure))
+            || !text(input.setup_outcome) || (input.target_ref !== null && !text(input.target_ref)))
+            return false;
+        for (const key of ["thread_id", "client_link_id"]) {
+            if (input[key] !== undefined && (!text(input[key]) || !UUID.test(input[key])))
+                return false;
+        }
+        if (input.pending_handle !== undefined && (!text(input.pending_handle) || !/^[a-zA-Z0-9_:.-]{1,128}$/.test(input.pending_handle)))
+            return false;
+        return true;
+    }
+    createArguments(input) {
+        if (!record(input) || !only(input, ["prompt", "title", "target"]) || !text(input.prompt)
+            || (input.title !== undefined && !text(input.title)))
+            return null;
+        const target = input.target;
+        if (!record(target) || !only(target, ["type", "projectId", "environment"])
+            || target.type !== "project" || target.projectId !== this.projectId
+            || !record(target.environment) || !only(target.environment, ["type"])
+            || target.environment.type !== "local")
+            return null;
+        // Copy only validated fields before awaiting discovery; do not pass mutable caller objects.
+        return { prompt: input.prompt, ...(input.title === undefined ? {} : { title: input.title }),
+            target: { type: "project", projectId: this.projectId, environment: { type: "local" } } };
+    }
+}

package/dist/src/daemon/codex-app-tools-host.js

@@ -0,0 +1,82 @@
+import { CodexAppSetupAdapter } from "./codex-app-setup.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const uuid = (value) => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+/** The observed official host envelope has one JSON text block. Fail closed on schema drift. */
+function data(value) {
+    if (!object(value) || (value.isError !== undefined && value.isError !== false)
+        || !Array.isArray(value.content) || value.content.length !== 1)
+        throw new Error("Unsupported app tool envelope");
+    const block = value.content[0];
+    if (!object(block) || block.type !== "text" || typeof block.text !== "string")
+        throw new Error("Missing app tool JSON");
+    const parsed = JSON.parse(block.text);
+    if (!object(parsed))
+        throw new Error("Unsupported app tool result");
+    return parsed;
+}
+export class CodexAppToolsHost {
+    tools;
+    hostId;
+    constructor(tools, hostId) {
+        this.tools = tools;
+        this.hostId = hostId;
+    }
+    async listProjects() {
+        const result = data(await this.tools.listProjects({}));
+        if (result.schemaVersion !== 2 || !Array.isArray(result.projects))
+            throw new Error("Unsupported project schema");
+        return result.projects.filter((project) => object(project)
+            && project.projectKind === "local" && typeof project.projectId === "string" && project.projectId.length > 0
+            && project.hostId === this.hostId).map(project => ({ projectId: project.projectId, hostId: this.hostId }));
+    }
+    async createThread(args) {
+        // Only the existing adapter calls this after Gateway's durable dispatch claim.
+        return data(await this.tools.createThread(args));
+    }
+    /** Observation only: never binds a session, reports bound, starts a turn or retries creation. */
+    async track(receipt) {
+        const unverified = { status: "unverified", grantsExecution: false };
+        if (!object(receipt) || Object.keys(receipt).some(key => !["threadId", "pendingHandle"].includes(key)))
+            return unverified;
+        if (receipt.pendingHandle !== undefined) {
+            if (receipt.threadId !== undefined || typeof receipt.pendingHandle !== "string"
+                || !/^[a-zA-Z0-9_:.-]{1,128}$/.test(receipt.pendingHandle))
+                return unverified;
+            // No exposed app tool resolves clientThreadId. In particular do not feed it to read_thread.
+            return { status: "pending_resolution_unsupported", pendingHandle: receipt.pendingHandle, grantsExecution: false };
+        }
+        if (!uuid(receipt.threadId))
+            return unverified;
+        const threadId = receipt.threadId;
+        try {
+            const result = data(await this.tools.readThread({ threadId, hostId: this.hostId, turnLimit: 1, includeOutputs: false, maxOutputCharsPerItem: 100 }));
+            if (result.schemaVersion !== 1 || !object(result.thread) || result.thread.id !== threadId
+                || result.thread.hostId !== this.hostId || result.thread.kind !== "codex")
+                return unverified;
+            return { status: "identity_observed", threadId, hostId: this.hostId, grantsExecution: false };
+        }
+        catch {
+            return unverified;
+        }
+    }
+}
+export function connectCodexAppSetup(deps) {
+    const host = new CodexAppToolsHost(deps.tools, deps.approvedHostId);
+    return { host, adapter: new CodexAppSetupAdapter({ ...deps, host }),
+        /** Pass normalized data from Gateway report(outcome: status), not an old prepare response. */
+        trackReceipt: async (receipt) => {
+            const unverified = { status: "unverified", grantsExecution: false };
+            if (!object(receipt) || !uuid(receipt.intent_id) || receipt.host_id !== deps.approvedHostId
+                || receipt.project_id !== deps.approvedProjectId || receipt.can_create !== false
+                || receipt.grants_execution !== false || receipt.authority_failure !== null
+                || receipt.create_thread !== undefined)
+                return unverified;
+            if (receipt.setup_outcome === "pending" && receipt.thread_id === undefined && typeof receipt.pending_handle === "string") {
+                return host.track({ pendingHandle: receipt.pending_handle });
+            }
+            if (receipt.setup_outcome === "created" && uuid(receipt.thread_id)) {
+                return host.track({ threadId: receipt.thread_id });
+            }
+            return unverified;
+        } };
+}

package/dist/src/daemon/execution-coordinator.js

@@ -1,7 +1,8 @@
 import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt } from '../verification/continuation-runner-contract.js';
 import { completionRejectionDiagnostic } from '../adapters/completion-report.js';
+import { runtimeFailureDiagnostic } from '../adapters/runtime-failure.js';
 import { assertCandidateReviewPackages, candidateReviewReport } from '../safety/candidate-review-report.js';
-import { D4_OBSERVED_EXECUTION_SCHEMA } from '../safety/d4-execution-limits.js';
+import { isD4ExecutionSchema } from '../safety/d4-execution-limits.js';
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
 import { assertP1Bindings, hasP1, p1ModelEvent } from '../verification/p1-execution-host.js';
@@ -179,7 +180,7 @@ export class ExecutionCoordinator {
             assertBoundExecutionAttempt(job, binding.taskPackage, binding.iterationId);
             if (executionAttempt && binding.bindingReplayed !== false)
                 throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
-            if (pkg.candidate_review_execution?.schema_version === D4_OBSERVED_EXECUTION_SCHEMA
+            if (isD4ExecutionSchema(pkg.candidate_review_execution?.schema_version)
                 && (job.generation !== 1 || binding.bindingReplayed !== false))
                 throw Error('D4_BINDING_RECONCILIATION_REQUIRED');
             binding = immutable(structuredClone(binding));
@@ -449,7 +450,7 @@ export class ExecutionCoordinator {
             if (isP1 && !hostProof)
                 event = p1ModelEvent(event);
             const previousStage = executionStage;
-            const d4StopAck = job.taskPackage.candidate_review_execution?.schema_version === D4_OBSERVED_EXECUTION_SCHEMA
+            const d4StopAck = isD4ExecutionSchema(job.taskPackage.candidate_review_execution?.schema_version)
                 && ['failed', 'cancelled', 'blocked'].includes(event.eventType);
             let payload = event.payload;
             if (isTerminalEventType(event.eventType) && !d4StopAck) {
@@ -833,6 +834,8 @@ export class ExecutionCoordinator {
         const reportDiagnostic = diagnostic && (status === "blocked"
             ? diagnostic.code === "CODEX_COMPLETION_REPORT_BLOCKED" : diagnostic.code !== "CODEX_COMPLETION_REPORT_BLOCKED") ? diagnostic : undefined;
         const rejectedCompletion = completionRejectionDiagnostic(terminal.payload?.completion_rejection);
+        // Why the provider CLI stopped, as a bounded code; only on a failed job.
+        const runtimeFailure = status === 'failed' ? runtimeFailureDiagnostic(terminal.payload?.runtime_failure) : undefined;
         const rejectedCounts = reportDiagnostic?.rejection_counts;
         if (rejectedCompletion || rejectedCounts) {
             try {
@@ -842,7 +845,7 @@ export class ExecutionCoordinator {
         }
         const securityReceipt = adapter.securityReceipt?.();
         const reads = safeLocalReadObservations(adapter.localReadObservations?.());
-        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(localFixPublication ? { local_fix_publication: structuredClone(localFixPublication) } : {}), ...(reason ? { reason } : {}), ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(rejectedCompletion ? { completion_rejection: rejectedCompletion } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
+        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(localFixPublication ? { local_fix_publication: structuredClone(localFixPublication) } : {}), ...(reason ? { reason } : {}), ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(rejectedCompletion ? { completion_rejection: rejectedCompletion } : {}), ...(runtimeFailure ? { runtime_failure: runtimeFailure } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
         await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
             phase: "terminal_pending", bindingId: binding.bindingId, terminalEventType: terminal.eventType,
             completionRequest: structuredClone(completionRequest) });

package/dist/src/daemon/runtime.js

@@ -1,3 +1,5 @@
+import { composeReviewedD4Host } from '../safety/d4-host-composition.js';
+import { protocolHash } from '../publication/candidate.js';
 import { createClaudeProductionHost } from '../safety/claude-production-host.js';
 import { adapterStatus } from '../adapters/status.js';
 import { loadInstalledLocalFixHost } from '../publication/installed-host.js';
@@ -15,7 +17,7 @@ import { CodexPlugin } from "../adapters/codex/plugin.js";
 import { buildCodexJobOptions } from "../adapters/codex/runtime-options.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
-import { D4_OBSERVED_EXECUTION_CAPABILITY } from '../safety/d4-execution-limits.js';
+import { D4_OBSERVED_EXECUTION_CAPABILITY, D4_RECORDED_EXECUTION_CAPABILITY } from '../safety/d4-execution-limits.js';
 import { createClaudeCodeAdapterOptions } from "../adapters/claude-code/runtime-options.js";
 import { ClaudeRunnerTokenStore, ensureClaudeKeychainStub } from "../safety/claude-runner-token.js";
 import { WorkspaceManager } from "../workspace/workspace-manager.js";
@@ -76,6 +78,39 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    // Only this daemon's currently executing claim may revalidate a D4 pre-spawn request.
+    let activeD4Job, activeD4Binding;
+    let d4Host = input.d4ExecutionHost, d4ProductionBinding;
+    if (!d4Host) {
+        const composition = await composeReviewedD4Host({ currentJob: () => {
+                const job = activeD4Job;
+                if (!job || !activeD4Binding)
+                    return undefined;
+                const pkg = job.taskPackage, repository = pkg.repository;
+                return { descriptor: pkg.candidate_review_execution, context: { jobId: job.id, bindingId: activeD4Binding, generation: job.generation,
+                        launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint },
+                    request: { adapterId: String(pkg.runtime_adapter), adapterVersion: String(pkg.runtime_adapter_version), jobId: job.id, generation: job.generation,
+                        modelId: String(pkg.resolved_model_id), sourceSha: String(repository?.base_commit_sha), requirements: pkg.security_requirements,
+                        launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint } };
+            }, binaryIdentity: () => claude.binaryIdentity(), revalidateJob: async (descriptor, context) => {
+                const job = activeD4Job;
+                if (!job || context.jobId !== job.id || context.bindingId !== activeD4Binding || context.generation !== 1 || job.generation !== 1
+                    || context.launchFingerprint !== job.launchFingerprint || context.contractFingerprint !== job.gatewayContractFingerprint
+                    || context.taskPackageFingerprint !== job.gatewayTaskPackageFingerprint
+                    || protocolHash(job.taskPackage) !== job.gatewayTaskPackageFingerprint
+                    || protocolHash(job.taskPackage.candidate_review_execution) !== protocolHash(descriptor))
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+                const { job: current } = await gateway.heartbeatLocalJob({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken });
+                if (activeD4Job !== job || activeD4Binding !== context.bindingId || current.id !== job.id || current.generation !== 1
+                    || !['claimed', 'shadowing', 'running'].includes(current.status) || !Number.isSafeInteger(current.lease_expires_at)
+                    || current.lease_expires_at <= Math.floor(Date.now() / 1000))
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+            } });
+        d4Host = composition.host;
+        if (composition.status === 'composed')
+            d4ProductionBinding = composition.productionBinding;
+        process.stderr.write(`${JSON.stringify({ event: 'd4_host', status: composition.status })}\n`);
+    }
     // The menu bar app (Work Item b9218937): counts and clickable notices; osascript stays the fallback.
     let roomActivityEnabled = false;
     const menubar = buildMenubar({ stateRoot: input.stateRoot, home: input.env.HOME ?? "", gatewayMcpUrl: input.gatewayMcpUrl,
@@ -121,10 +156,12 @@ export async function buildDaemon(input) {
         options: async ({ worktreePath, jobId }) => createClaudeCodeAdapterOptions({
             worktreePath, jobId, stateRoot: input.stateRoot, env: input.env,
             maxBudgetUsd: Number.MAX_SAFE_INTEGER, hookExecutablePath: hook.hookScriptPath, hookNodeExecutablePath: hook.nodeExecutablePath,
-            securityHost: claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
+            securityHost: activeD4Job?.id === jobId && claudeProduction
+                ? d4ProductionBinding ? claudeProduction.d4SecurityHost(d4ProductionBinding) : async () => { throw Error('D4_REVIEW_HOST_REQUIRED'); }
+                : claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
             pullRequestEvidence: (args, signal) => gateway.readPullRequestEvidence(args, signal),
             readCandidateReviewContext: loopId => gateway.readCandidateReviewContext(loopId),
-            d4ExecutionHost: input.d4ExecutionHost,
+            d4ExecutionHost: d4Host,
         }),
     });
     const codex = new CodexPlugin({
@@ -156,10 +193,15 @@ export async function buildDaemon(input) {
             shadow: (job, signal) => gateway.localJobShadow({ workLoopId: job.workLoopId,
                 contractFingerprint: job.gatewayContractFingerprint ?? "",
                 taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "" }, signal),
-            createBinding: async (job, signal) => gateway.createLocalJobBinding({
-                jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
-                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
-            }, signal),
+            createBinding: async (job, signal) => {
+                const binding = await gateway.createLocalJobBinding({
+                    jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
+                    launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
+                }, signal);
+                if (activeD4Job?.id === job.id)
+                    activeD4Binding = binding.bindingId;
+                return binding;
+            },
             publicationRecoveryContext: bindingId => gateway.exportLocalPublicationRecoveryContext(bindingId),
             syncPublicationCursor: (bindingId, cursor, job, receipt) => gateway.syncLocalPublicationCursor(bindingId, cursor, job, receipt),
             confirmServerPublicationCompletion: (bindingId, cursor, job, receipt) => gateway.confirmServerPublicationCompletion(bindingId, cursor, job, receipt),
@@ -221,7 +263,22 @@ export async function buildDaemon(input) {
             return { status: "claimed", job };
         },
         execute: async (job) => {
-            await coordinator.execute(job);
+            const claimed = job;
+            if (claimed.taskPackage.candidate_review_execution) {
+                if (activeD4Job)
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+                activeD4Job = structuredClone(claimed);
+                activeD4Binding = undefined;
+                try {
+                    await coordinator.execute(claimed);
+                }
+                finally {
+                    activeD4Job = undefined;
+                    activeD4Binding = undefined;
+                }
+            }
+            else
+                await coordinator.execute(claimed);
         },
         requestSync: reason => { transport?.requestSync(reason); },
         // Until now the heartbeat said this runner takes no jobs; tell the Gateway at once, and ask whether one waits.
@@ -298,10 +355,16 @@ export async function buildDaemon(input) {
             }
             const askInbox = await asks.advertisement();
             const guidance = await guide.advertisement();
+            let d4Ready;
+            try {
+                if (d4Host && (!d4Host.ready || await d4Host.ready()))
+                    d4Ready = d4Host;
+            }
+            catch { /* D4 readiness never disables other workflows. */ }
             return {
                 deviceFingerprint: runnerDeviceFingerprint(input.gatewayMcpUrl),
                 displayName: runnerDisplayName(), packageVersion: packageVersion(),
-                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])], input.d4ExecutionHost), poller.accepting),
+                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])], d4Ready), poller.accepting),
                 mode: "full",
                 ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
                 ...(guidance ? { guidance } : {}),
@@ -471,7 +534,7 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
     return probes.map(probe => {
         const status = adapterStatus(probe);
         const authenticated = status.authenticated;
-        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1' && value !== D4_OBSERVED_EXECUTION_CAPABILITY);
+        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1' && value !== D4_OBSERVED_EXECUTION_CAPABILITY && value !== D4_RECORDED_EXECUTION_CAPABILITY);
         if (trustedLocalFixHost && authenticated && isLocalFixAdapter(probe.id)) {
             capabilities.push('local_fix_publication_v1');
             if (modes.includes('gateway_ci_v1'))
@@ -484,7 +547,7 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
             capabilities.push('pull_request_evidence_v1');
         const d4 = authenticated && probe.id === 'claude_code_cli' && d4Host;
         if (d4)
-            capabilities.push(D4_OBSERVED_EXECUTION_CAPABILITY);
+            capabilities.push(...(d4.capabilities ?? [D4_OBSERVED_EXECUTION_CAPABILITY, D4_RECORDED_EXECUTION_CAPABILITY]));
         return { adapter: probe.id, version: probe.version, ...status, capabilities, ...(d4 ? { runner_release_sha256: d4.runnerReleaseSha256, host_policy_sha256: d4.hostPolicySha256 } : {}) };
     });
 }

package/dist/src/safety/claude-production-host.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { assertReviewedD4Request } from './d4-host-composition.js';
 import { execFile, spawn } from 'node:child_process';
 import { CLAUDE_TOKEN_FD, CLAUDE_TOKEN_FD_ENV, pathWithKeychainStub } from './claude-runner-token.js';
 import { lstat, realpath } from 'node:fs/promises';
@@ -256,13 +257,15 @@ export function createClaudeProductionHost(input) {
     };
     const blocked = (code, executableVersion) => ({ available: false, authenticated: false, loginStatus: 'unknown', capabilities: [], reason: code,
         ...(executableVersion ? { executableVersion } : {}), admission: { checks: [{ id: CHECK_IDS[code] ?? 'release_copy', status: 'blocked', code }] } });
-    const securityHost = async (request) => {
+    const createSecurityHost = (d4) => async (request) => {
         if (closed)
             throw Error('CLAUDE_HOST_CLOSED');
         const requirements = requireClaudeRequirements(request.requirements, { adapterId: request.adapterId, adapterVersion: request.adapterVersion }), release = requirements.release;
+        if (d4)
+            await assertReviewedD4Request(d4, request);
         const { release: synced, binary } = await verifiedCopy();
         if (release.version !== synced.version || release.platform !== synced.platform || release.binary_sha256 !== synced.binary_sha256
-            || !isDeepStrictEqual([...release.model_ids], [...synced.model_ids]) || release.platform !== platform || !release.model_ids.includes(request.modelId))
+            || (!d4 && !isDeepStrictEqual([...release.model_ids], [...synced.model_ids])) || release.platform !== platform || !release.model_ids.includes(request.modelId))
             throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
         const tools = claudeReleaseToolInventory(release);
         await verifyClaudeCodeSignature(binary, input.codesign);
@@ -277,6 +280,8 @@ export function createClaudeProductionHost(input) {
             verify: async (captured) => {
                 if (closed || captured.binarySha256 !== release.binary_sha256 || captured.securityMode !== CLAUDE_RELEASE_MODE)
                     throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+                if (d4)
+                    await assertReviewedD4Request(d4, request);
                 await verifyClaudeReleaseCopy(input.home, release).catch(error => { probeMemo = undefined; throw error; });
                 return { version: 2, pin: captured, checks: CLAUDE_MANDATORY_GATES.map(gate => ({ gate, status: 'passed' })) };
             } };
@@ -328,7 +333,13 @@ export function createClaudeProductionHost(input) {
             const { binary } = await verifiedCopy();
             return captureClaudeBinaryIdentity({ launchPath: binary, allowedRoots: [claudeReleaseRoot(input.home)] });
         },
-        securityHost,
+        securityHost: createSecurityHost(),
+        /** A separate capability issued by reviewed composition; no task/env field can relax generic model equality. */
+        d4SecurityHost(binding) {
+            if (!binding)
+                throw Error('D4_HOST_INPUT_REJECTED');
+            return createSecurityHost(binding);
+        },
         async close() { closed = true; abort.abort(); await pending; },
     };
 }

package/dist/src/safety/claude-review-provider.js

@@ -23,6 +23,14 @@ function textOf(content) {
     const parts = content.filter((block) => record(block) && block.type === 'text' && typeof block.text === 'string').map(block => block.text);
     return parts.length ? parts.join('') : null;
 }
+/** Tool evidence accepts text only. Never discard an unrecognized block and salvage a passing JSON object. */
+function toolResultText(content) {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content) || content.length === 0 || !content.every((block) => record(block) && Object.keys(block).length === 2 && block.type === 'text' && typeof block.text === 'string'))
+        return 'CLAUDE_REVIEW_TOOL_RESULT_CONTENT_REJECTED';
+    return content.map(block => block.text).join('');
+}
 const REMINDER = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
 /** The user's own text. The real CLI prepends context in system-reminder tags, in its own block or the same one. */
 function userText(content) {
@@ -131,7 +139,7 @@ export async function startClaudeReviewProvider(script) {
                         continue;
                     toolResultIds.push(block.tool_use_id);
                     if (!toolResults.has(block.tool_use_id))
-                        toolResults.set(block.tool_use_id, { isError: block.is_error === true, text: typeof block.content === 'string' ? block.content : JSON.stringify(block.content ?? '') });
+                        toolResults.set(block.tool_use_id, { isError: block.is_error === true, text: toolResultText(block.content) });
                 }
         const firstUser = messages.find(message => message.role === 'user'), { text: firstUserText, reminders } = firstUser ? userText(firstUser.content) : { text: null, reminders: 0 };
         // The scripted turn: the launched model, the exact review prompt as the first user text and an offered tool list.