mtech-ai-local-runner 0.1.12 → 0.1.14

package/README.md

@@ -10,6 +10,14 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.14: foreground administrator authentication wait
+
+The manual Codex pilot waits for administrator authentication before starting
+the 60-second profile inventory deadline. Cancelling the execution aborts its
+owned pending query. Fixed error codes identify authentication and query failures
+without exposing native stderr. This patch does not update a running daemon or
+establish successful real-account Codex execution.
+
 ## 0.1.10: enforced PreToolUse hook
 
 Earlier releases configured a hook command that the shell could not run, so Claude
@@ -125,6 +133,20 @@ or cost termination limits on an approved unbounded employee-local Claude run.
 Existing generation fencing, scope restrictions, cancellation and audit remain
 in force.
 
+### MCP startup failure diagnostics (0.1.13)
+
+Codex startup now distinguishes an owned process exiting before admission,
+preparation timeout, explicit abort and rejected MCP discovery. A fixed `detail`
+reports whether initialize, initialized notification or tool inventory is still
+missing (or discovery completed). The first issued cause survives cleanup and
+outer catches and reaches both the failed event and terminal Job result.
+Raw provider stderr remains excluded. These diagnostics do not establish the
+historical failure cause or prove whether provider inference occurred.
+
+The preparation deadline and mandatory authenticated MCP checks are unchanged.
+There is no automatic model retry or task duration/count cap. Installing this
+patch does not authorize another actual Codex attempt or change login/settings.
+
 ### Post-binding execution diagnostics (0.1.12)
 
 The manual command and daemon log an `execution_failed` diagnostic (the manual
@@ -139,4 +161,11 @@ into a completed job. Existing reconciliation rules still apply.
 
 ### Manual Codex pilot (0.1.11)
 
+The foreground inventory separates human authentication wait from the bounded
+query and evidence freshness. Its query deadline starts only after the fixed
+root-identity check completes, not while the administrator prompt is waiting.
+Cancellation revokes the pending query and rejects late results; authentication,
+query timeout, command and validation failures use distinct safe codes. The
+inventory must still be fresh at Codex spawn. No automatic retry is performed.
+
 The reviewed manual Codex path preserves the existing CLI and ChatGPT login. It is separate from unattended daemon readiness. After the exact CLI/native reader and Gateway release are installed, an employee-authorized foreground pilot uses `mtec-ai-local-runner manual-codex --job-id=<approved Job UUID>`. It refuses a running daemon, unresolved recovery state, unknown release/account or a different Job. It does not stop services or alter personal settings. A direct administrator policy inventory occurs just before the approved execution; historical inventory is not continuous MDM monitoring. The Gateway OAuth client refuses refresh in this manual command. Actual vendor account startup may still refresh shared credentials and requires disclosure in the exact launch approval.

package/dist/src/adapters/codex/exec-launch-host.js

@@ -63,13 +63,16 @@ export class CodexExecLaunchHost {
         this.ownsAttempt = true;
         this.used = true;
         let stage = 'codex_context';
+        let interruption;
+        const mcpDetail = () => stage === 'codex_mcp' ? this.deps.execTools?.discoveryDetail() : undefined;
+        const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail()); };
         let timer, external;
         try {
             this.assertContext(ctx, jobId);
             requireOfficialExecPlan(this.plan);
             if (typeof prompt !== 'string' || !prompt || prompt.length > 1_000_000 || signal?.aborted)
                 throw fail();
-            const stopped = new Promise((_, reject) => { external = () => { void this.cancel().catch(() => { }); reject(fail()); }; this.abort.signal.addEventListener('abort', () => reject(fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(external, 30_000); });
+            const stopped = new Promise((_, reject) => { external = () => { interrupt('CODEX_EXEC_ABORTED'); void this.cancel().catch(() => { }); reject(interruption); }; this.abort.signal.addEventListener('abort', () => reject(interruption ?? fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(() => { interrupt('CODEX_EXEC_PREPARATION_TIMEOUT'); external(); }, 30_000); });
             const preparation = (async () => {
                 const supported = isReleaseExecMode(this.plan.mode);
                 stage = 'codex_inspection';
@@ -95,6 +98,8 @@ export class CodexExecLaunchHost {
                     throw fail();
                 }
                 h.once('exit', (code, signal) => {
+                    if (!this.stopped && !this.receiptValue)
+                        interrupt('CODEX_EXEC_PROCESS_EXITED');
                     // Preserve audit only for a clean owned exit that was still authorized.
                     // This immutable record never restores tool or spawn authority.
                     if (code === 0 && signal === null && !this.stopped && this.receiptValue) {
@@ -153,7 +158,7 @@ export class CodexExecLaunchHost {
             return await Promise.race([preparation, stopped]);
         }
         catch (error) {
-            const safe = executionError(error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED');
+            const safe = executionError(interruption ?? error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED', mcpDetail());
             await this.cancel().catch(() => { });
             throw safe;
         }

package/dist/src/adapters/codex/exec-tool-gate.js

@@ -1,6 +1,7 @@
 import { isReleaseExecMode, requireOfficialExecPlan } from './exec-invocation.js';
 import { localDiscoveryScopeMatches, localToolInventory } from '../../safety/local-tool-server.js';
 import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+import { executionError } from '../../safety/execution-failure.js';
 const denied = () => Error('EXEC_TOOL_GATE_REJECTED');
 /** Host-owned capability, never populated from stdout/task data. Authenticated
  * discovery is server-side evidence; it does not attest OS client identity. */
@@ -29,6 +30,9 @@ export class ExecToolGate {
     catch {
         return false;
     } }
+    /** Metadata only: survives revocation; contains no endpoint or credential. */
+    discoveryDetail() { return ['mcp_initialize_missing', 'mcp_initialized_missing', 'mcp_inventory_missing', 'mcp_discovery_complete'][this.stage]; }
+    readinessError() { return executionError(denied(), 'codex_mcp', 'CODEX_EXEC_MCP_REJECTED', this.discoveryDetail()); }
     promptSubmitted(process) { if (this.process !== process || this.submitted || !this.active())
         throw denied(); this.submitted = true; }
     discovery = (event, scope) => {
@@ -60,17 +64,17 @@ export class ExecToolGate {
     };
     async wait(process, signal) {
         if (this.process !== process || !this.submitted || !this.active() || signal.aborted)
-            throw denied();
+            throw this.readinessError();
         if (this.stage !== 3)
             await new Promise((resolve, reject) => {
-                const abort = () => { clear(); reject(denied()); };
+                const abort = () => { clear(); reject(this.readinessError()); };
                 const clear = () => { signal.removeEventListener('abort', abort); this.settle = undefined; this.reject = undefined; };
                 this.reject = abort;
                 this.settle = () => { clear(); resolve(); };
                 signal.addEventListener('abort', abort, { once: true });
             });
         if (!this.active() || signal.aborted || this.stage !== 3)
-            throw denied();
+            throw this.readinessError();
         return { process, executionNonce: this.plan.executionNonce, endpoint: this.plan.endpoint, authenticated: true, ready: true, toolSchemaFingerprint: this.plan.identity.toolSchemaFingerprint, tools: localToolInventory().map(t => t.name), isCurrent: () => this.active() && this.stage === 3 };
     }
     authorize(process) { if (process !== this.process || !this.active() || this.stage !== 3)

package/dist/src/daemon/manual-codex.js

@@ -55,8 +55,8 @@ export async function runManualCodexJob(input, deps) {
                                 inner.attachCleanup(cleanup);
                             return inner.prepare(ctx);
                         }, async inspect(plan) { if (!inner)
-                            throw Error('MANUAL_PILOT_NOT_PREPARED'); return inner.inspect(plan); }, revoke() { inner?.revoke(); }, attachCleanup(fn) { if (cleanup)
-                            throw Error('MANUAL_PILOT_DUPLICATE_CLEANUP'); cleanup = fn; }, async close() { await inner?.close(); } };
+                            throw Error('MANUAL_PILOT_NOT_PREPARED'); return inner.inspect(plan); }, revoke() { controller?.cancel(); inner?.revoke(); }, attachCleanup(fn) { if (cleanup)
+                            throw Error('MANUAL_PILOT_DUPLICATE_CLEANUP'); cleanup = fn; }, async close() { controller?.cancel(); await inner?.close(); } };
                     const plugin = new CodexPlugin({ probe, options: () => buildCodexExecJobOptions({ jobId: job.id, worktreePath: options.worktreePath, stateRoot: input.stateRoot, env: input.env, productionJob: () => lazy, processHost: deps?.processHost }) });
                     adapter = await plugin.create(options);
                     return adapter;

package/dist/src/safety/codex-manual-controller.js

@@ -25,8 +25,10 @@ export function createManualPilotController(input, deps) {
     const claim = structuredClone(input.claim), releases = structuredClone(deps?.releases ?? CODEX_EXEC_RELEASES), readLocal = deps?.readLocal, now = deps?.now ?? Date.now;
     const account = path.resolve(input.codexHome ?? path.join(input.home, '.codex'));
     let used = false, closed = false, manual, host;
-    const close = async () => { closed = true; manual?.revoke(); await host?.close(); };
-    return Object.freeze({ close, async prepare() {
+    const queryAbort = new AbortController();
+    const cancel = () => { closed = true; queryAbort.abort(); manual?.revoke(); };
+    const close = async () => { cancel(); await host?.close(); };
+    return Object.freeze({ close, cancel, async prepare() {
             if (used || closed)
                 throw rejected();
             used = true;
@@ -65,7 +67,7 @@ export function createManualPilotController(input, deps) {
                 if (closed)
                     throw rejected();
                 stage = 'codex_manual_inventory';
-                const inventory = await (deps?.collectInventory ?? createManualProfileQuery().collectOnce)();
+                const inventory = await (deps?.collectInventory ?? createManualProfileQuery().collectOnce)(queryAbort.signal);
                 if (closed)
                     throw rejected();
                 stage = 'codex_manual_policy_scope';

package/dist/src/safety/codex-manual-profile-query.js

@@ -1,30 +1,175 @@
 import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
 import { emptyProfileInventoryXml } from './codex-native-observation.js';
+import { executionError, executionFailure } from './execution-failure.js';
 const rejected = () => Error('CODEX_MANUAL_PROFILE_QUERY_REJECTED');
-/** Two fixed read-only commands, under one interactive administrator grant.
- * No user command, path, credential, profile write or persistent root process. */
-export const MANUAL_PROFILES_ARGUMENTS = Object.freeze(['-e', `set uid to do shell script "/usr/bin/id -u" with administrator privileges\nif uid is not "0" then error "Unexpected query identity"\nset inventory to do shell script "/usr/bin/profiles list -all -output stdout-xml" with administrator privileges\nreturn uid & linefeed & inventory`]);
-const exec = promisify(execFile);
-const nativeRun = async (binary, args) => exec(binary, [...args], { encoding: 'utf8', timeout: 60_000, maxBuffer: 1_048_576, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } });
-/** Instantiate only in the trusted foreground controller immediately before an
- * approved pilot, never in the unattended daemon probe. Metadata output only. */
+const AUTHENTICATED = 'MTEC_PROFILE_AUTHENTICATED_V1';
+const QUERY_TIMEOUT_MS = 60_000;
+const failureMarkers = Object.freeze({
+    MTEC_PROFILE_AUTH_CANCELLED: 'CODEX_MANUAL_AUTH_CANCELLED',
+    MTEC_PROFILE_AUTH_REJECTED: 'CODEX_MANUAL_AUTH_REJECTED',
+    MTEC_PROFILE_QUERY_TIMEOUT: 'CODEX_MANUAL_QUERY_TIMEOUT',
+    MTEC_PROFILE_QUERY_FAILED: 'CODEX_MANUAL_QUERY_COMMAND_FAILED',
+    MTEC_PROFILE_NONROOT: 'CODEX_MANUAL_QUERY_NONROOT',
+});
+const failure = (code) => executionError(rejected(), 'codex_manual_inventory', code);
+/** No Runner deadline while the employee is authenticating. The fixed first
+ * command acquires the grant; only then does the bounded read-only query start.
+ * No user commands, credential writes or persistent privileged process. */
+export const MANUAL_PROFILES_ARGUMENTS = Object.freeze(['-e', `with timeout of 2147483647 seconds
+ try
+  set uid to do shell script "/usr/bin/id -u" with administrator privileges
+ on error messageText number errorNumber
+  if errorNumber is -128 then
+   log "MTEC_PROFILE_AUTH_CANCELLED"
+  else
+   log "MTEC_PROFILE_AUTH_REJECTED"
+  end if
+  error "Administrator authentication failed" number 10001
+ end try
+ if uid is not "0" then
+  log "MTEC_PROFILE_NONROOT"
+  error "Unexpected query identity" number 10002
+ end if
+ log "MTEC_PROFILE_AUTHENTICATED_V1"
+ try
+  with timeout of 60 seconds
+   set inventory to do shell script "/usr/bin/profiles list -all -output stdout-xml" with administrator privileges
+  end timeout
+ on error messageText number errorNumber
+  if errorNumber is -1712 then
+   log "MTEC_PROFILE_QUERY_TIMEOUT"
+  else
+   log "MTEC_PROFILE_QUERY_FAILED"
+  end if
+  error "Profile inventory failed" number 10003
+ end try
+ return uid & linefeed & inventory
+end timeout`]);
+/** Injectable process seam, never a task-provided command. Protocol markers are
+ * fixed by our script; raw native stderr is discarded rather than published. */
+export function createManualProfileProcessRunner(start = execFile) {
+    return (binary, args, options) => new Promise((resolve, reject) => {
+        let pending = '', marked = false, reason, settled = false;
+        let child;
+        const finishError = (error) => { if (settled)
+            return; settled = true; reject(error); };
+        try {
+            child = start(binary, [...args], { encoding: 'utf8', timeout: 0, maxBuffer: 1_048_576, signal: options.signal, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } }, (error, stdout, stderr) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (error) {
+                    reject(reason ? failure(reason) : executionError(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED'));
+                    return;
+                }
+                if (reason) {
+                    reject(failure(reason));
+                    return;
+                }
+                if (!marked) {
+                    reject(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                    return;
+                }
+                const rest = String(stderr).split(/\r?\n/).filter(line => line !== AUTHENTICATED && line !== '').join('\n');
+                resolve({ stdout: String(stdout), stderr: rest });
+            });
+            child.stderr?.on('data', (chunk) => {
+                if (settled)
+                    return;
+                pending += chunk.toString();
+                if (pending.length > 1_048_576) {
+                    finishError(failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID'));
+                    child?.kill();
+                    return;
+                }
+                let end;
+                while ((end = pending.indexOf('\n')) !== -1) {
+                    const line = pending.slice(0, end).replace(/\r$/, '');
+                    pending = pending.slice(end + 1);
+                    if (Object.hasOwn(failureMarkers, line))
+                        reason = failureMarkers[line];
+                    if (line === AUTHENTICATED) {
+                        if (marked) {
+                            finishError(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                            child?.kill();
+                            return;
+                        }
+                        marked = true;
+                        try {
+                            options.onAuthenticated();
+                        }
+                        catch {
+                            finishError(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                            child?.kill();
+                            return;
+                        }
+                    }
+                }
+            });
+        }
+        catch (error) {
+            finishError(executionError(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED'));
+        }
+    });
+}
+const nativeRun = createManualProfileProcessRunner();
+/** Foreground-only, single-use, cancellable. Human authentication wait is not
+ * query age: evidence is stamped when the bounded inventory actually finishes. */
 export function createManualProfileQuery(input) {
     const run = input?.run ?? nativeRun, now = input?.now ?? Date.now;
     let used = false;
-    return Object.freeze({ async collectOnce() {
+    return Object.freeze({ async collectOnce(signal) {
             if (used)
-                throw rejected();
+                throw failure('CODEX_MANUAL_QUERY_REUSED');
             used = true;
+            const controller = new AbortController();
+            let timer;
+            let firstFailure, authenticatedAt;
+            const abort = (code) => { firstFailure ??= failure(code); controller.abort(); };
+            const externalAbort = () => abort('CODEX_MANUAL_QUERY_ABORTED');
+            signal?.addEventListener('abort', externalAbort, { once: true });
             try {
-                const startedAt = now(), result = await run('/usr/bin/osascript', MANUAL_PROFILES_ARGUMENTS), observedAt = now();
-                if (!Number.isSafeInteger(startedAt) || startedAt < 0 || !Number.isSafeInteger(observedAt) || observedAt < startedAt || observedAt - startedAt > 60_000 || result.stderr !== '' || typeof result.stdout !== 'string' || !result.stdout.startsWith('0\n') || !emptyProfileInventoryXml(result.stdout.slice(2)))
-                    throw rejected();
+                if (signal?.aborted) {
+                    externalAbort();
+                    throw firstFailure;
+                }
+                const startedAt = now();
+                if (!Number.isSafeInteger(startedAt) || startedAt < 0)
+                    throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                // Reject independently of whether an injected/native runner settles on abort.
+                const cancelled = new Promise((_, reject) => { controller.signal.addEventListener('abort', () => reject(firstFailure), { once: true }); });
+                const operation = run('/usr/bin/osascript', MANUAL_PROFILES_ARGUMENTS, { signal: controller.signal, onAuthenticated() {
+                        if (controller.signal.aborted || authenticatedAt !== undefined)
+                            throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                        authenticatedAt = now();
+                        if (!Number.isSafeInteger(authenticatedAt) || authenticatedAt < startedAt)
+                            throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                        timer = setTimeout(() => abort('CODEX_MANUAL_QUERY_TIMEOUT'), QUERY_TIMEOUT_MS);
+                    } });
+                const result = await Promise.race([operation, cancelled]), observedAt = now();
+                if (firstFailure)
+                    throw firstFailure;
+                if (authenticatedAt === undefined || !Number.isSafeInteger(observedAt) || observedAt < authenticatedAt)
+                    throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                if (observedAt - authenticatedAt > QUERY_TIMEOUT_MS)
+                    throw failure('CODEX_MANUAL_QUERY_TIMEOUT');
+                if (typeof result.stdout !== 'string' || result.stderr !== '' || !result.stdout.includes('\n'))
+                    throw failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID');
+                if (!result.stdout.startsWith('0\n'))
+                    throw failure('CODEX_MANUAL_QUERY_NONROOT');
+                if (!emptyProfileInventoryXml(result.stdout.slice(2)))
+                    throw failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID');
                 return Object.freeze({ version: 1, exit: 0, euid: 0, scope: 'machine_and_current_user', complete: true, empty: true, observedAt, inventoryFingerprint: createHash('sha256').update(result.stdout.slice(2)).digest('hex') });
             }
-            catch {
-                throw rejected();
+            catch (error) {
+                const diagnostic = executionFailure(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED');
+                throw firstFailure ?? executionError(error, 'codex_manual_inventory', diagnostic.code);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+                signal?.removeEventListener('abort', externalAbort);
             }
         } });
 }

package/dist/src/safety/execution-failure.js

@@ -24,8 +24,12 @@ export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     }
     return { stage, code: fallback };
 }
-export function executionError(error, stage, fallback) {
+export function executionError(error, stage, fallback, detail) {
     const diagnostic = executionFailure(error, stage, fallback);
+    // Only trusted callers supply this fixed vocabulary. Serialized provider
+    // errors, messages and stderr never become diagnostic authority.
+    if (!issued.has(error) && ['mcp_initialize_missing', 'mcp_initialized_missing', 'mcp_inventory_missing', 'mcp_discovery_complete'].includes(detail))
+        diagnostic.detail = detail;
     const safe = new Error(fallback);
     issued.set(safe, Object.freeze(diagnostic));
     return safe;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "private": false,
   "license": "UNLICENSED",
   "bin": {