mtech-ai-local-runner 0.1.112 → 0.1.113

package/dist/src/daemon/codex-app-setup.js

@@ -0,0 +1,125 @@
+import { createHash } from "node:crypto";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const text = (value) => typeof value === "string" && value.trim().length > 0;
+const only = (value, allowed) => Object.keys(value).every(key => allowed.includes(key));
+/**
+ * Consumes a fresh Gateway prepare receipt, never creates its own authority or binds a recipient.
+ * Gateway atomically grants a one-use dispatch claim before the external side effect. The local
+ * fence additionally blocks duplicate calls on this adapter, including lost claim acknowledgements.
+ * No concrete native endpoint is wired here. A caller must supply the supported authenticated host.
+ */
+export class CodexAppSetupAdapter {
+    deps;
+    attempted = new Set();
+    hostId;
+    projectId;
+    constructor(deps) {
+        this.deps = deps;
+        if (!text(deps.approvedHostId) || !text(deps.approvedProjectId))
+            throw new Error("Explicit approved host and project required");
+        this.hostId = deps.approvedHostId;
+        this.projectId = deps.approvedProjectId;
+    }
+    async execute(input) {
+        if (!this.validReceipt(input))
+            return { status: "rejected" };
+        if (!input.can_create || this.attempted.has(input.intent_id))
+            return { status: "skipped" };
+        if (input.setup_outcome !== "reserved" || input.target_ref !== null || input.authority_failure !== null
+            || input.thread_id !== undefined || input.pending_handle !== undefined || input.client_link_id !== undefined)
+            return { status: "rejected" };
+        const args = this.createArguments(input.create_thread);
+        if (!args || createHash("sha256").update(args.prompt, "utf8").digest("hex") !== input.setup_prompt_sha256)
+            return { status: "rejected" };
+        const intentId = input.intent_id;
+        const expiresAt = input.expires_at;
+        const setupPromptSha256 = input.setup_prompt_sha256;
+        // Fence before any await. A discovery failure cannot cause an accidental concurrent retry.
+        this.attempted.add(intentId);
+        try {
+            const projects = await this.deps.host.listProjects();
+            if (!Array.isArray(projects) || !projects.some(project => record(project)
+                && project.projectId === this.projectId && project.hostId === this.hostId))
+                return { status: "rejected" };
+        }
+        catch {
+            return { status: "rejected" };
+        }
+        if (expiresAt <= Date.now() / 1000)
+            return { status: "rejected" };
+        let claim;
+        try {
+            claim = await this.deps.claimDispatch({ intent_id: intentId, host_id: this.hostId, project_id: this.projectId, outcome: "dispatch" });
+        }
+        catch {
+            return { status: "uncertain", reportRecorded: false };
+        }
+        if (!this.validReceipt(claim) || claim.intent_id !== intentId)
+            return { status: "uncertain", reportRecorded: false };
+        if (!claim.can_create)
+            return { status: "skipped" };
+        if (claim.setup_prompt_sha256 !== setupPromptSha256 || createHash("sha256").update(args.prompt, "utf8").digest("hex") !== claim.setup_prompt_sha256
+            || claim.setup_outcome !== "dispatching" || claim.target_ref !== null || claim.authority_failure !== null
+            || claim.thread_id !== undefined || claim.pending_handle !== undefined || claim.client_link_id !== undefined
+            || expiresAt <= Date.now() / 1000)
+            return { status: "uncertain", reportRecorded: false };
+        const report = { intent_id: intentId, host_id: this.hostId, project_id: this.projectId, outcome: "uncertain" };
+        try {
+            const result = await this.deps.host.createThread(args);
+            if (record(result)) {
+                if (text(result.threadId) && UUID.test(result.threadId) && result.hostId === this.hostId && result.clientThreadId === undefined) {
+                    report.outcome = "created";
+                    report.thread_id = result.threadId;
+                }
+                else if (text(result.clientThreadId) && result.threadId === undefined
+                    && (result.hostId === undefined || result.hostId === this.hostId)) {
+                    report.outcome = "pending";
+                    report.pending_handle = result.clientThreadId;
+                }
+            }
+        }
+        catch {
+            // The host may have created the thread before losing its acknowledgement. Never replay.
+        }
+        try {
+            await this.deps.report(report);
+            return { status: report.outcome, reportRecorded: true };
+        }
+        catch {
+            // Even a successful host response is not reconciled when Gateway's acknowledgement is lost.
+            return { status: "uncertain", reportRecorded: false };
+        }
+    }
+    validReceipt(input) {
+        if (!record(input) || !only(input, ["intent_id", "host_id", "project_id", "can_create", "create_thread", "setup_outcome", "target_ref", "grants_execution", "expires_at", "authority_failure", "thread_id", "pending_handle", "client_link_id", "setup_prompt_sha256"])
+            || !text(input.intent_id) || !UUID.test(input.intent_id) || input.host_id !== this.hostId || input.project_id !== this.projectId
+            || typeof input.setup_prompt_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(input.setup_prompt_sha256)
+            || typeof input.can_create !== "boolean" || input.grants_execution !== false
+            || typeof input.expires_at !== "number" || !Number.isSafeInteger(input.expires_at) || input.expires_at <= Date.now() / 1000
+            || (input.authority_failure !== null && !text(input.authority_failure))
+            || !text(input.setup_outcome) || (input.target_ref !== null && !text(input.target_ref)))
+            return false;
+        for (const key of ["thread_id", "client_link_id"]) {
+            if (input[key] !== undefined && (!text(input[key]) || !UUID.test(input[key])))
+                return false;
+        }
+        if (input.pending_handle !== undefined && (!text(input.pending_handle) || !/^[a-zA-Z0-9_:.-]{1,128}$/.test(input.pending_handle)))
+            return false;
+        return true;
+    }
+    createArguments(input) {
+        if (!record(input) || !only(input, ["prompt", "title", "target"]) || !text(input.prompt)
+            || (input.title !== undefined && !text(input.title)))
+            return null;
+        const target = input.target;
+        if (!record(target) || !only(target, ["type", "projectId", "environment"])
+            || target.type !== "project" || target.projectId !== this.projectId
+            || !record(target.environment) || !only(target.environment, ["type"])
+            || target.environment.type !== "local")
+            return null;
+        // Copy only validated fields before awaiting discovery; do not pass mutable caller objects.
+        return { prompt: input.prompt, ...(input.title === undefined ? {} : { title: input.title }),
+            target: { type: "project", projectId: this.projectId, environment: { type: "local" } } };
+    }
+}

package/dist/src/daemon/codex-app-tools-host.js

@@ -0,0 +1,82 @@
+import { CodexAppSetupAdapter } from "./codex-app-setup.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const uuid = (value) => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+/** The observed official host envelope has one JSON text block. Fail closed on schema drift. */
+function data(value) {
+    if (!object(value) || (value.isError !== undefined && value.isError !== false)
+        || !Array.isArray(value.content) || value.content.length !== 1)
+        throw new Error("Unsupported app tool envelope");
+    const block = value.content[0];
+    if (!object(block) || block.type !== "text" || typeof block.text !== "string")
+        throw new Error("Missing app tool JSON");
+    const parsed = JSON.parse(block.text);
+    if (!object(parsed))
+        throw new Error("Unsupported app tool result");
+    return parsed;
+}
+export class CodexAppToolsHost {
+    tools;
+    hostId;
+    constructor(tools, hostId) {
+        this.tools = tools;
+        this.hostId = hostId;
+    }
+    async listProjects() {
+        const result = data(await this.tools.listProjects({}));
+        if (result.schemaVersion !== 2 || !Array.isArray(result.projects))
+            throw new Error("Unsupported project schema");
+        return result.projects.filter((project) => object(project)
+            && project.projectKind === "local" && typeof project.projectId === "string" && project.projectId.length > 0
+            && project.hostId === this.hostId).map(project => ({ projectId: project.projectId, hostId: this.hostId }));
+    }
+    async createThread(args) {
+        // Only the existing adapter calls this after Gateway's durable dispatch claim.
+        return data(await this.tools.createThread(args));
+    }
+    /** Observation only: never binds a session, reports bound, starts a turn or retries creation. */
+    async track(receipt) {
+        const unverified = { status: "unverified", grantsExecution: false };
+        if (!object(receipt) || Object.keys(receipt).some(key => !["threadId", "pendingHandle"].includes(key)))
+            return unverified;
+        if (receipt.pendingHandle !== undefined) {
+            if (receipt.threadId !== undefined || typeof receipt.pendingHandle !== "string"
+                || !/^[a-zA-Z0-9_:.-]{1,128}$/.test(receipt.pendingHandle))
+                return unverified;
+            // No exposed app tool resolves clientThreadId. In particular do not feed it to read_thread.
+            return { status: "pending_resolution_unsupported", pendingHandle: receipt.pendingHandle, grantsExecution: false };
+        }
+        if (!uuid(receipt.threadId))
+            return unverified;
+        const threadId = receipt.threadId;
+        try {
+            const result = data(await this.tools.readThread({ threadId, hostId: this.hostId, turnLimit: 1, includeOutputs: false, maxOutputCharsPerItem: 100 }));
+            if (result.schemaVersion !== 1 || !object(result.thread) || result.thread.id !== threadId
+                || result.thread.hostId !== this.hostId || result.thread.kind !== "codex")
+                return unverified;
+            return { status: "identity_observed", threadId, hostId: this.hostId, grantsExecution: false };
+        }
+        catch {
+            return unverified;
+        }
+    }
+}
+export function connectCodexAppSetup(deps) {
+    const host = new CodexAppToolsHost(deps.tools, deps.approvedHostId);
+    return { host, adapter: new CodexAppSetupAdapter({ ...deps, host }),
+        /** Pass normalized data from Gateway report(outcome: status), not an old prepare response. */
+        trackReceipt: async (receipt) => {
+            const unverified = { status: "unverified", grantsExecution: false };
+            if (!object(receipt) || !uuid(receipt.intent_id) || receipt.host_id !== deps.approvedHostId
+                || receipt.project_id !== deps.approvedProjectId || receipt.can_create !== false
+                || receipt.grants_execution !== false || receipt.authority_failure !== null
+                || receipt.create_thread !== undefined)
+                return unverified;
+            if (receipt.setup_outcome === "pending" && receipt.thread_id === undefined && typeof receipt.pending_handle === "string") {
+                return host.track({ pendingHandle: receipt.pending_handle });
+            }
+            if (receipt.setup_outcome === "created" && uuid(receipt.thread_id)) {
+                return host.track({ threadId: receipt.thread_id });
+            }
+            return unverified;
+        } };
+}

package/dist/src/daemon/runtime.js

@@ -80,9 +80,19 @@ export async function buildDaemon(input) {
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
     // Only this daemon's currently executing claim may revalidate a D4 pre-spawn request.
     let activeD4Job, activeD4Binding;
-    let d4Host = input.d4ExecutionHost;
+    let d4Host = input.d4ExecutionHost, d4ProductionBinding;
     if (!d4Host) {
-        const composition = await composeReviewedD4Host({ binaryIdentity: () => claude.binaryIdentity(), revalidateJob: async (descriptor, context) => {
+        const composition = await composeReviewedD4Host({ currentJob: () => {
+                const job = activeD4Job;
+                if (!job || !activeD4Binding)
+                    return undefined;
+                const pkg = job.taskPackage, repository = pkg.repository;
+                return { descriptor: pkg.candidate_review_execution, context: { jobId: job.id, bindingId: activeD4Binding, generation: job.generation,
+                        launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint },
+                    request: { adapterId: String(pkg.runtime_adapter), adapterVersion: String(pkg.runtime_adapter_version), jobId: job.id, generation: job.generation,
+                        modelId: String(pkg.resolved_model_id), sourceSha: String(repository?.base_commit_sha), requirements: pkg.security_requirements,
+                        launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint } };
+            }, binaryIdentity: () => claude.binaryIdentity(), revalidateJob: async (descriptor, context) => {
                 const job = activeD4Job;
                 if (!job || context.jobId !== job.id || context.bindingId !== activeD4Binding || context.generation !== 1 || job.generation !== 1
                     || context.launchFingerprint !== job.launchFingerprint || context.contractFingerprint !== job.gatewayContractFingerprint
@@ -97,6 +107,8 @@ export async function buildDaemon(input) {
                     throw Error('D4_JOB_CONTEXT_REJECTED');
             } });
         d4Host = composition.host;
+        if (composition.status === 'composed')
+            d4ProductionBinding = composition.productionBinding;
         process.stderr.write(`${JSON.stringify({ event: 'd4_host', status: composition.status })}\n`);
     }
     // The menu bar app (Work Item b9218937): counts and clickable notices; osascript stays the fallback.
@@ -144,7 +156,9 @@ export async function buildDaemon(input) {
         options: async ({ worktreePath, jobId }) => createClaudeCodeAdapterOptions({
             worktreePath, jobId, stateRoot: input.stateRoot, env: input.env,
             maxBudgetUsd: Number.MAX_SAFE_INTEGER, hookExecutablePath: hook.hookScriptPath, hookNodeExecutablePath: hook.nodeExecutablePath,
-            securityHost: claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
+            securityHost: activeD4Job?.id === jobId && claudeProduction
+                ? d4ProductionBinding ? claudeProduction.d4SecurityHost(d4ProductionBinding) : async () => { throw Error('D4_REVIEW_HOST_REQUIRED'); }
+                : claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
             pullRequestEvidence: (args, signal) => gateway.readPullRequestEvidence(args, signal),
             readCandidateReviewContext: loopId => gateway.readCandidateReviewContext(loopId),
             d4ExecutionHost: d4Host,

package/dist/src/safety/claude-production-host.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { assertReviewedD4Request } from './d4-host-composition.js';
 import { execFile, spawn } from 'node:child_process';
 import { CLAUDE_TOKEN_FD, CLAUDE_TOKEN_FD_ENV, pathWithKeychainStub } from './claude-runner-token.js';
 import { lstat, realpath } from 'node:fs/promises';
@@ -256,13 +257,15 @@ export function createClaudeProductionHost(input) {
     };
     const blocked = (code, executableVersion) => ({ available: false, authenticated: false, loginStatus: 'unknown', capabilities: [], reason: code,
         ...(executableVersion ? { executableVersion } : {}), admission: { checks: [{ id: CHECK_IDS[code] ?? 'release_copy', status: 'blocked', code }] } });
-    const securityHost = async (request) => {
+    const createSecurityHost = (d4) => async (request) => {
         if (closed)
             throw Error('CLAUDE_HOST_CLOSED');
         const requirements = requireClaudeRequirements(request.requirements, { adapterId: request.adapterId, adapterVersion: request.adapterVersion }), release = requirements.release;
+        if (d4)
+            await assertReviewedD4Request(d4, request);
         const { release: synced, binary } = await verifiedCopy();
         if (release.version !== synced.version || release.platform !== synced.platform || release.binary_sha256 !== synced.binary_sha256
-            || !isDeepStrictEqual([...release.model_ids], [...synced.model_ids]) || release.platform !== platform || !release.model_ids.includes(request.modelId))
+            || (!d4 && !isDeepStrictEqual([...release.model_ids], [...synced.model_ids])) || release.platform !== platform || !release.model_ids.includes(request.modelId))
             throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
         const tools = claudeReleaseToolInventory(release);
         await verifyClaudeCodeSignature(binary, input.codesign);
@@ -277,6 +280,8 @@ export function createClaudeProductionHost(input) {
             verify: async (captured) => {
                 if (closed || captured.binarySha256 !== release.binary_sha256 || captured.securityMode !== CLAUDE_RELEASE_MODE)
                     throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+                if (d4)
+                    await assertReviewedD4Request(d4, request);
                 await verifyClaudeReleaseCopy(input.home, release).catch(error => { probeMemo = undefined; throw error; });
                 return { version: 2, pin: captured, checks: CLAUDE_MANDATORY_GATES.map(gate => ({ gate, status: 'passed' })) };
             } };
@@ -328,7 +333,13 @@ export function createClaudeProductionHost(input) {
             const { binary } = await verifiedCopy();
             return captureClaudeBinaryIdentity({ launchPath: binary, allowedRoots: [claudeReleaseRoot(input.home)] });
         },
-        securityHost,
+        securityHost: createSecurityHost(),
+        /** A separate capability issued by reviewed composition; no task/env field can relax generic model equality. */
+        d4SecurityHost(binding) {
+            if (!binding)
+                throw Error('D4_HOST_INPUT_REJECTED');
+            return createSecurityHost(binding);
+        },
         async close() { closed = true; abort.abort(); await pending; },
     };
 }

package/dist/src/safety/d4-host-composition.js

@@ -9,7 +9,15 @@ import { assertCurrentClaudeBinary, claudeBinaryLaunchPath } from './claude-bina
 import { localToolInventory } from './local-tool-server.js';
 import { CLAUDE_LAUNCH_CONFIG } from './claude-production-host.js';
 import { assertD4PackageLimitSupport, D4_RECORDED_EXECUTION_SCHEMA, D4_RECORDED_EXECUTION_CAPABILITY } from './d4-execution-limits.js';
+import { requireClaudeRequirements } from './claude-release.js';
 import { REVIEWED_D4_HOST_REGISTRATIONS } from './d4-reviewed-hosts.js';
+const productionBindings = new WeakMap();
+export async function assertReviewedD4Request(binding, request) {
+    const assert = productionBindings.get(binding);
+    if (!assert)
+        throw denied();
+    await assert(request);
+}
 const denied = () => Error('D4_HOST_INPUT_REJECTED');
 const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
 const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
@@ -92,7 +100,38 @@ export async function composeReviewedD4Host(input) {
                     throw denied();
                 }
             } });
-        return { status: 'composed', host };
+        let productionBinding;
+        if (input.currentJob) {
+            const currentJob = input.currentJob;
+            productionBinding = Object.freeze({ purpose: 'd4-reviewed-production-binding-v1' });
+            productionBindings.set(productionBinding, async (request) => {
+                try {
+                    const requirements = requireClaudeRequirements(request.requirements, request), release = requirements.release;
+                    if (requirements.fingerprint !== p.cli_security_fingerprint || request.modelId !== p.model_id || request.generation !== 1
+                        || release.binary_sha256 !== p.claude_binary_sha256 || release.tools_sha256 !== p.tools_sha256
+                        || release.model_ids.length !== 1 || release.model_ids[0] !== p.model_id)
+                        throw denied();
+                    const current = currentJob();
+                    if (!current)
+                        throw denied();
+                    const snapshot = structuredClone(current);
+                    if (protocolHash(snapshot.request) !== protocolHash(request))
+                        throw denied();
+                    for (const key of ['jobId', 'generation', 'launchFingerprint', 'contractFingerprint', 'taskPackageFingerprint'])
+                        if (snapshot.context[key] !== request[key])
+                            throw denied();
+                    await host.assertCurrent(snapshot.descriptor, snapshot.context);
+                    // The current claim, binding, candidate/actor pins and requirements must survive every asynchronous check.
+                    const after = currentJob();
+                    if (!after || protocolHash(after) !== protocolHash(snapshot))
+                        throw denied();
+                }
+                catch {
+                    throw denied();
+                }
+            });
+        }
+        return { status: 'composed', host, ...(productionBinding ? { productionBinding } : {}) };
     }
     catch {
         return { status: 'mismatch' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.112",
+  "version": "0.1.113",
   "private": false,
   "license": "UNLICENSED",
   "bin": {
@@ -8,8 +8,6 @@
   },
   "files": [
     "dist/src",
-    "claude-mod",
-    "!claude-mod/**/*.test.tsx",
     "README.md",
     "LICENSE",
     "native/bin/codex-observe-darwin-arm64",

package/claude-mod/.claude-plugin/marketplace.json

@@ -1 +0,0 @@
-{ "name": "mtec-ai-gateway", "owner": { "name": "mtech-ai-local-runner" }, "plugins": [{ "name": "ai-gateway-work-room", "source": "./" }] }

package/claude-mod/.claude-plugin/plugin.json

@@ -1 +0,0 @@
-{ "name": "ai-gateway-work-room", "version": "1.5.0", "description": "Work Room shares and requests from colleagues beside the conversation, installed by mtech-ai-local-runner (Work Item 98da2635).", "types": "./types/index.d.ts" }

package/claude-mod/hooks/gateway.ts

@@ -1,47 +0,0 @@
-import type { EngineInterface } from 'claude-code'
-
-import { clean } from './model'
-
-/*
- * Every Gateway call the Work Room pane makes goes through the person's own Claude AI Gateway connector (Work Item
- * 98da2635, owner choice 2026-10-30), with no model turn. The connector's server name differs by setup:
- * `ai-gateway` from an MCP config, an id in the desktop app; tools are found by their name suffix.
- */
-
-export type GatewayTool = 'work_room_read' | 'work_room_write' | 'work_room_receipt_report' | 'work_inbox' | 'work_request_answer'
-export type GatewayAnswer =
-  | { ok: true; payload: unknown }
-  | { ok: false; state: 'no-connector' | 'refused' | 'error'; detail: string }
-
-export function findTool(tools: readonly { name: string; mcp: boolean }[], name: GatewayTool): string | undefined {
-  const names = tools
-    .filter(tool => tool.mcp && tool.name.startsWith('mcp__') && tool.name.endsWith(`__${name}`))
-    .map(tool => tool.name)
-
-  return names.find(found => found === `mcp__ai-gateway__${name}`) ?? names[0]
-}
-
-/** One call. A press passes its consent; a timer passes none. Never throws. */
-export async function callGateway($: EngineInterface, name: GatewayTool, input: Record<string, unknown>, consent?: string): Promise<GatewayAnswer> {
-  try {
-    const tool = findTool(await $.tool.list(), name)
-    if (tool === undefined) return { ok: false, state: 'no-connector', detail: name }
-    // Typed loosely: the MCP tool union is too deep for the type checker. $.tool.call stays spelled at the call site.
-    const answer = (await $.tool.call({ tool, ...input, ...(consent ? { consent } : {}) } as never)) as {
-      deny?: string
-      result?: unknown
-      text?: string
-      isError?: boolean
-    }
-    if (answer.deny !== undefined) return { ok: false, state: 'refused', detail: clean(answer.deny, 400) }
-    if (answer.isError) {
-      const detail = clean(typeof answer.result === 'string' ? answer.result : answer.text, 400)
-
-      return { ok: false, state: 'error', detail: detail || 'Gateway error' }
-    }
-
-    return { ok: true, payload: { result: answer.result, text: answer.text } }
-  } catch (error) {
-    return { ok: false, state: 'error', detail: clean(error instanceof Error ? error.message : 'Gateway call failed', 400) }
-  }
-}

package/claude-mod/hooks/hooks.json

@@ -1,34 +0,0 @@
-{
-  "modules": ["./register.tsx"],
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "^mcp__.+__(work_room_read|work_inbox)$",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"Work Room pane: reading your own AI Gateway Rooms and requests is allowed.\"}}'"
-          }
-        ]
-      },
-      {
-        "matcher": "^mcp__.+__work_room_receipt_report$",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "if grep -Eq '\"state\"[[:space:]]*:[[:space:]]*\"presented\"'; then printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"Work Room pane: recording that it showed you these Room messages is allowed.\"}}'; else printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Work Room: marking Room messages read tells the AI Gateway you read them. Allow it?\"}}'; fi"
-          }
-        ]
-      },
-      {
-        "matcher": "^mcp__.+__(work_room_write|work_request_answer)$",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Work Room: this sends what you wrote to colleagues through the AI Gateway. Allow it?\"}}'"
-          }
-        ]
-      }
-    ]
-  }
-}