mtech-ai-local-runner 0.1.13 → 0.1.14

package/README.md

@@ -10,6 +10,14 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.14: foreground administrator authentication wait
+
+The manual Codex pilot waits for administrator authentication before starting
+the 60-second profile inventory deadline. Cancelling the execution aborts its
+owned pending query. Fixed error codes identify authentication and query failures
+without exposing native stderr. This patch does not update a running daemon or
+establish successful real-account Codex execution.
+
 ## 0.1.10: enforced PreToolUse hook
 
 Earlier releases configured a hook command that the shell could not run, so Claude
@@ -153,4 +161,11 @@ into a completed job. Existing reconciliation rules still apply.
 
 ### Manual Codex pilot (0.1.11)
 
+The foreground inventory separates human authentication wait from the bounded
+query and evidence freshness. Its query deadline starts only after the fixed
+root-identity check completes, not while the administrator prompt is waiting.
+Cancellation revokes the pending query and rejects late results; authentication,
+query timeout, command and validation failures use distinct safe codes. The
+inventory must still be fresh at Codex spawn. No automatic retry is performed.
+
 The reviewed manual Codex path preserves the existing CLI and ChatGPT login. It is separate from unattended daemon readiness. After the exact CLI/native reader and Gateway release are installed, an employee-authorized foreground pilot uses `mtec-ai-local-runner manual-codex --job-id=<approved Job UUID>`. It refuses a running daemon, unresolved recovery state, unknown release/account or a different Job. It does not stop services or alter personal settings. A direct administrator policy inventory occurs just before the approved execution; historical inventory is not continuous MDM monitoring. The Gateway OAuth client refuses refresh in this manual command. Actual vendor account startup may still refresh shared credentials and requires disclosure in the exact launch approval.

package/dist/src/daemon/manual-codex.js

@@ -55,8 +55,8 @@ export async function runManualCodexJob(input, deps) {
                                 inner.attachCleanup(cleanup);
                             return inner.prepare(ctx);
                         }, async inspect(plan) { if (!inner)
-                            throw Error('MANUAL_PILOT_NOT_PREPARED'); return inner.inspect(plan); }, revoke() { inner?.revoke(); }, attachCleanup(fn) { if (cleanup)
-                            throw Error('MANUAL_PILOT_DUPLICATE_CLEANUP'); cleanup = fn; }, async close() { await inner?.close(); } };
+                            throw Error('MANUAL_PILOT_NOT_PREPARED'); return inner.inspect(plan); }, revoke() { controller?.cancel(); inner?.revoke(); }, attachCleanup(fn) { if (cleanup)
+                            throw Error('MANUAL_PILOT_DUPLICATE_CLEANUP'); cleanup = fn; }, async close() { controller?.cancel(); await inner?.close(); } };
                     const plugin = new CodexPlugin({ probe, options: () => buildCodexExecJobOptions({ jobId: job.id, worktreePath: options.worktreePath, stateRoot: input.stateRoot, env: input.env, productionJob: () => lazy, processHost: deps?.processHost }) });
                     adapter = await plugin.create(options);
                     return adapter;

package/dist/src/safety/codex-manual-controller.js

@@ -25,8 +25,10 @@ export function createManualPilotController(input, deps) {
     const claim = structuredClone(input.claim), releases = structuredClone(deps?.releases ?? CODEX_EXEC_RELEASES), readLocal = deps?.readLocal, now = deps?.now ?? Date.now;
     const account = path.resolve(input.codexHome ?? path.join(input.home, '.codex'));
     let used = false, closed = false, manual, host;
-    const close = async () => { closed = true; manual?.revoke(); await host?.close(); };
-    return Object.freeze({ close, async prepare() {
+    const queryAbort = new AbortController();
+    const cancel = () => { closed = true; queryAbort.abort(); manual?.revoke(); };
+    const close = async () => { cancel(); await host?.close(); };
+    return Object.freeze({ close, cancel, async prepare() {
             if (used || closed)
                 throw rejected();
             used = true;
@@ -65,7 +67,7 @@ export function createManualPilotController(input, deps) {
                 if (closed)
                     throw rejected();
                 stage = 'codex_manual_inventory';
-                const inventory = await (deps?.collectInventory ?? createManualProfileQuery().collectOnce)();
+                const inventory = await (deps?.collectInventory ?? createManualProfileQuery().collectOnce)(queryAbort.signal);
                 if (closed)
                     throw rejected();
                 stage = 'codex_manual_policy_scope';

package/dist/src/safety/codex-manual-profile-query.js

@@ -1,30 +1,175 @@
 import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
 import { emptyProfileInventoryXml } from './codex-native-observation.js';
+import { executionError, executionFailure } from './execution-failure.js';
 const rejected = () => Error('CODEX_MANUAL_PROFILE_QUERY_REJECTED');
-/** Two fixed read-only commands, under one interactive administrator grant.
- * No user command, path, credential, profile write or persistent root process. */
-export const MANUAL_PROFILES_ARGUMENTS = Object.freeze(['-e', `set uid to do shell script "/usr/bin/id -u" with administrator privileges\nif uid is not "0" then error "Unexpected query identity"\nset inventory to do shell script "/usr/bin/profiles list -all -output stdout-xml" with administrator privileges\nreturn uid & linefeed & inventory`]);
-const exec = promisify(execFile);
-const nativeRun = async (binary, args) => exec(binary, [...args], { encoding: 'utf8', timeout: 60_000, maxBuffer: 1_048_576, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } });
-/** Instantiate only in the trusted foreground controller immediately before an
- * approved pilot, never in the unattended daemon probe. Metadata output only. */
+const AUTHENTICATED = 'MTEC_PROFILE_AUTHENTICATED_V1';
+const QUERY_TIMEOUT_MS = 60_000;
+const failureMarkers = Object.freeze({
+    MTEC_PROFILE_AUTH_CANCELLED: 'CODEX_MANUAL_AUTH_CANCELLED',
+    MTEC_PROFILE_AUTH_REJECTED: 'CODEX_MANUAL_AUTH_REJECTED',
+    MTEC_PROFILE_QUERY_TIMEOUT: 'CODEX_MANUAL_QUERY_TIMEOUT',
+    MTEC_PROFILE_QUERY_FAILED: 'CODEX_MANUAL_QUERY_COMMAND_FAILED',
+    MTEC_PROFILE_NONROOT: 'CODEX_MANUAL_QUERY_NONROOT',
+});
+const failure = (code) => executionError(rejected(), 'codex_manual_inventory', code);
+/** No Runner deadline while the employee is authenticating. The fixed first
+ * command acquires the grant; only then does the bounded read-only query start.
+ * No user commands, credential writes or persistent privileged process. */
+export const MANUAL_PROFILES_ARGUMENTS = Object.freeze(['-e', `with timeout of 2147483647 seconds
+ try
+  set uid to do shell script "/usr/bin/id -u" with administrator privileges
+ on error messageText number errorNumber
+  if errorNumber is -128 then
+   log "MTEC_PROFILE_AUTH_CANCELLED"
+  else
+   log "MTEC_PROFILE_AUTH_REJECTED"
+  end if
+  error "Administrator authentication failed" number 10001
+ end try
+ if uid is not "0" then
+  log "MTEC_PROFILE_NONROOT"
+  error "Unexpected query identity" number 10002
+ end if
+ log "MTEC_PROFILE_AUTHENTICATED_V1"
+ try
+  with timeout of 60 seconds
+   set inventory to do shell script "/usr/bin/profiles list -all -output stdout-xml" with administrator privileges
+  end timeout
+ on error messageText number errorNumber
+  if errorNumber is -1712 then
+   log "MTEC_PROFILE_QUERY_TIMEOUT"
+  else
+   log "MTEC_PROFILE_QUERY_FAILED"
+  end if
+  error "Profile inventory failed" number 10003
+ end try
+ return uid & linefeed & inventory
+end timeout`]);
+/** Injectable process seam, never a task-provided command. Protocol markers are
+ * fixed by our script; raw native stderr is discarded rather than published. */
+export function createManualProfileProcessRunner(start = execFile) {
+    return (binary, args, options) => new Promise((resolve, reject) => {
+        let pending = '', marked = false, reason, settled = false;
+        let child;
+        const finishError = (error) => { if (settled)
+            return; settled = true; reject(error); };
+        try {
+            child = start(binary, [...args], { encoding: 'utf8', timeout: 0, maxBuffer: 1_048_576, signal: options.signal, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } }, (error, stdout, stderr) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (error) {
+                    reject(reason ? failure(reason) : executionError(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED'));
+                    return;
+                }
+                if (reason) {
+                    reject(failure(reason));
+                    return;
+                }
+                if (!marked) {
+                    reject(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                    return;
+                }
+                const rest = String(stderr).split(/\r?\n/).filter(line => line !== AUTHENTICATED && line !== '').join('\n');
+                resolve({ stdout: String(stdout), stderr: rest });
+            });
+            child.stderr?.on('data', (chunk) => {
+                if (settled)
+                    return;
+                pending += chunk.toString();
+                if (pending.length > 1_048_576) {
+                    finishError(failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID'));
+                    child?.kill();
+                    return;
+                }
+                let end;
+                while ((end = pending.indexOf('\n')) !== -1) {
+                    const line = pending.slice(0, end).replace(/\r$/, '');
+                    pending = pending.slice(end + 1);
+                    if (Object.hasOwn(failureMarkers, line))
+                        reason = failureMarkers[line];
+                    if (line === AUTHENTICATED) {
+                        if (marked) {
+                            finishError(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                            child?.kill();
+                            return;
+                        }
+                        marked = true;
+                        try {
+                            options.onAuthenticated();
+                        }
+                        catch {
+                            finishError(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                            child?.kill();
+                            return;
+                        }
+                    }
+                }
+            });
+        }
+        catch (error) {
+            finishError(executionError(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED'));
+        }
+    });
+}
+const nativeRun = createManualProfileProcessRunner();
+/** Foreground-only, single-use, cancellable. Human authentication wait is not
+ * query age: evidence is stamped when the bounded inventory actually finishes. */
 export function createManualProfileQuery(input) {
     const run = input?.run ?? nativeRun, now = input?.now ?? Date.now;
     let used = false;
-    return Object.freeze({ async collectOnce() {
+    return Object.freeze({ async collectOnce(signal) {
             if (used)
-                throw rejected();
+                throw failure('CODEX_MANUAL_QUERY_REUSED');
             used = true;
+            const controller = new AbortController();
+            let timer;
+            let firstFailure, authenticatedAt;
+            const abort = (code) => { firstFailure ??= failure(code); controller.abort(); };
+            const externalAbort = () => abort('CODEX_MANUAL_QUERY_ABORTED');
+            signal?.addEventListener('abort', externalAbort, { once: true });
             try {
-                const startedAt = now(), result = await run('/usr/bin/osascript', MANUAL_PROFILES_ARGUMENTS), observedAt = now();
-                if (!Number.isSafeInteger(startedAt) || startedAt < 0 || !Number.isSafeInteger(observedAt) || observedAt < startedAt || observedAt - startedAt > 60_000 || result.stderr !== '' || typeof result.stdout !== 'string' || !result.stdout.startsWith('0\n') || !emptyProfileInventoryXml(result.stdout.slice(2)))
-                    throw rejected();
+                if (signal?.aborted) {
+                    externalAbort();
+                    throw firstFailure;
+                }
+                const startedAt = now();
+                if (!Number.isSafeInteger(startedAt) || startedAt < 0)
+                    throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                // Reject independently of whether an injected/native runner settles on abort.
+                const cancelled = new Promise((_, reject) => { controller.signal.addEventListener('abort', () => reject(firstFailure), { once: true }); });
+                const operation = run('/usr/bin/osascript', MANUAL_PROFILES_ARGUMENTS, { signal: controller.signal, onAuthenticated() {
+                        if (controller.signal.aborted || authenticatedAt !== undefined)
+                            throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                        authenticatedAt = now();
+                        if (!Number.isSafeInteger(authenticatedAt) || authenticatedAt < startedAt)
+                            throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                        timer = setTimeout(() => abort('CODEX_MANUAL_QUERY_TIMEOUT'), QUERY_TIMEOUT_MS);
+                    } });
+                const result = await Promise.race([operation, cancelled]), observedAt = now();
+                if (firstFailure)
+                    throw firstFailure;
+                if (authenticatedAt === undefined || !Number.isSafeInteger(observedAt) || observedAt < authenticatedAt)
+                    throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                if (observedAt - authenticatedAt > QUERY_TIMEOUT_MS)
+                    throw failure('CODEX_MANUAL_QUERY_TIMEOUT');
+                if (typeof result.stdout !== 'string' || result.stderr !== '' || !result.stdout.includes('\n'))
+                    throw failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID');
+                if (!result.stdout.startsWith('0\n'))
+                    throw failure('CODEX_MANUAL_QUERY_NONROOT');
+                if (!emptyProfileInventoryXml(result.stdout.slice(2)))
+                    throw failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID');
                 return Object.freeze({ version: 1, exit: 0, euid: 0, scope: 'machine_and_current_user', complete: true, empty: true, observedAt, inventoryFingerprint: createHash('sha256').update(result.stdout.slice(2)).digest('hex') });
             }
-            catch {
-                throw rejected();
+            catch (error) {
+                const diagnostic = executionFailure(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED');
+                throw firstFailure ?? executionError(error, 'codex_manual_inventory', diagnostic.code);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+                signal?.removeEventListener('abort', externalAbort);
             }
         } });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": false,
   "license": "UNLICENSED",
   "bin": {