mtech-ai-local-runner 0.1.13 → 0.1.15

package/README.md

@@ -10,6 +10,24 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.15: startup output before MCP readiness
+
+The process host drains stdout from spawn, before the adapter starts consuming
+events after authenticated MCP discovery. A bounded queue prevents the child
+from blocking on ordinary startup output; overflow stops only its owned process
+group. This changes no tool permissions, preparation deadlines or task limits.
+Fake-process tests reproduce the defect, but do not prove the cause of a previous
+real-account failure or successful account/MCP acceptance. Publication and a
+foreground installation do not update the daemon or authorize a model run.
+
+## 0.1.14: foreground administrator authentication wait
+
+The manual Codex pilot waits for administrator authentication before starting
+the 60-second profile inventory deadline. Cancelling the execution aborts its
+owned pending query. Fixed error codes identify authentication and query failures
+without exposing native stderr. This patch does not update a running daemon or
+establish successful real-account Codex execution.
+
 ## 0.1.10: enforced PreToolUse hook
 
 Earlier releases configured a hook command that the shell could not run, so Claude
@@ -153,4 +171,11 @@ into a completed job. Existing reconciliation rules still apply.
 
 ### Manual Codex pilot (0.1.11)
 
+The foreground inventory separates human authentication wait from the bounded
+query and evidence freshness. Its query deadline starts only after the fixed
+root-identity check completes, not while the administrator prompt is waiting.
+Cancellation revokes the pending query and rejects late results; authentication,
+query timeout, command and validation failures use distinct safe codes. The
+inventory must still be fresh at Codex spawn. No automatic retry is performed.
+
 The reviewed manual Codex path preserves the existing CLI and ChatGPT login. It is separate from unattended daemon readiness. After the exact CLI/native reader and Gateway release are installed, an employee-authorized foreground pilot uses `mtec-ai-local-runner manual-codex --job-id=<approved Job UUID>`. It refuses a running daemon, unresolved recovery state, unknown release/account or a different Job. It does not stop services or alter personal settings. A direct administrator policy inventory occurs just before the approved execution; historical inventory is not continuous MDM monitoring. The Gateway OAuth client refuses refresh in this manual command. Actual vendor account startup may still refresh shared credentials and requires disclosure in the exact launch approval.

package/dist/src/daemon/manual-codex.js

@@ -55,8 +55,8 @@ export async function runManualCodexJob(input, deps) {
                                 inner.attachCleanup(cleanup);
                             return inner.prepare(ctx);
                         }, async inspect(plan) { if (!inner)
-                            throw Error('MANUAL_PILOT_NOT_PREPARED'); return inner.inspect(plan); }, revoke() { inner?.revoke(); }, attachCleanup(fn) { if (cleanup)
-                            throw Error('MANUAL_PILOT_DUPLICATE_CLEANUP'); cleanup = fn; }, async close() { await inner?.close(); } };
+                            throw Error('MANUAL_PILOT_NOT_PREPARED'); return inner.inspect(plan); }, revoke() { controller?.cancel(); inner?.revoke(); }, attachCleanup(fn) { if (cleanup)
+                            throw Error('MANUAL_PILOT_DUPLICATE_CLEANUP'); cleanup = fn; }, async close() { controller?.cancel(); await inner?.close(); } };
                     const plugin = new CodexPlugin({ probe, options: () => buildCodexExecJobOptions({ jobId: job.id, worktreePath: options.worktreePath, stateRoot: input.stateRoot, env: input.env, productionJob: () => lazy, processHost: deps?.processHost }) });
                     adapter = await plugin.create(options);
                     return adapter;

package/dist/src/process/node-process-group-host.js

@@ -7,6 +7,19 @@ export class NodeProcessGroupHost {
         const child = spawn(command, args, { ...options, shell: false, detached: true, stdio: ["pipe", "pipe", "pipe"] });
         let failure;
         let owned = true;
+        let finished = false, consumed = false, queuedBytes = 0, wake;
+        const lines = [];
+        const MAX_QUEUED_BYTES = 1_048_576, MAX_QUEUED_LINES = 8192;
+        const notify = () => { const resolve = wake; wake = undefined; resolve?.(); };
+        let termination;
+        const exitCallbacks = [];
+        const terminated = (code, signal) => {
+            if (termination)
+                return;
+            termination = { code, signal };
+            for (const callback of exitCallbacks.splice(0))
+                callback(code, signal);
+        };
         const kill = (signal = "SIGKILL") => {
             if (!owned || !child.pid)
                 return;
@@ -28,47 +41,105 @@ export class NodeProcessGroupHost {
             if (signal === "SIGKILL")
                 owned = false;
         };
-        child.on("error", () => { failure = new Error("Provider process could not start"); });
-        child.stdin.on("error", () => { failure = new Error("Provider process input closed"); });
+        child.on("error", () => { failure ??= new Error("Provider process could not start"); terminated(null, null); notify(); });
+        child.stdin.on("error", () => {
+            failure ??= new Error("Provider process input closed");
+            try {
+                kill();
+            }
+            catch {
+                failure = new Error('Provider process group cleanup could not be confirmed');
+            }
+            terminated(null, null);
+            notify();
+        });
         // Provider stderr can contain account details. Consume without publishing it.
         child.stderr.resume();
-        child.once("exit", () => {
+        child.once("exit", (code, signal) => {
             try {
                 kill();
             }
             catch {
                 failure = new Error("Provider process group cleanup could not be confirmed");
             }
+            terminated(code, signal);
         });
+        // Drain from spawn, not from the first adapter event read: official exec can
+        // emit startup events before it initializes MCP, while the adapter awaits
+        // that initialization before consuming events. Bound the pre-consumer queue.
+        void (async () => {
+            let pending = Buffer.alloc(0);
+            const enqueue = (line) => {
+                if (line.length > 256_000)
+                    throw new Error("Provider event exceeded the allowed size");
+                if (queuedBytes + line.length + 1 > MAX_QUEUED_BYTES || lines.length >= MAX_QUEUED_LINES)
+                    throw new Error("Provider event buffer exceeded the allowed size");
+                lines.push({ text: line.toString('utf8').replace(/\r$/, ''), bytes: line.length + 1 });
+                queuedBytes += line.length + 1;
+                notify();
+            };
+            try {
+                for await (const chunk of child.stdout) {
+                    pending = Buffer.concat([pending, Buffer.from(chunk)]);
+                    let end;
+                    while ((end = pending.indexOf(10)) !== -1) {
+                        enqueue(pending.subarray(0, end));
+                        pending = pending.subarray(end + 1);
+                    }
+                    if (pending.length > 256_000)
+                        throw new Error("Provider event exceeded the allowed size");
+                }
+                if (pending.length)
+                    enqueue(pending);
+            }
+            catch (error) {
+                failure ??= error instanceof Error && ['Provider event exceeded the allowed size', 'Provider event buffer exceeded the allowed size'].includes(error.message) ? error : new Error('Provider event stream failed');
+                try {
+                    kill();
+                }
+                catch {
+                    failure = new Error('Provider process group cleanup could not be confirmed');
+                }
+            }
+            finally {
+                finished = true;
+                notify();
+            }
+        })();
         return {
             stdin: { write: (text) => { child.stdin.write(text); }, end: () => { child.stdin.end(); } },
             stdout: { async *[Symbol.asyncIterator]() {
-                    let pending = Buffer.alloc(0);
+                    if (consumed)
+                        throw new Error('Provider event stream already consumed');
+                    consumed = true;
                     try {
-                        for await (const chunk of child.stdout) {
-                            pending = Buffer.concat([pending, Buffer.from(chunk)]);
-                            let end;
-                            while ((end = pending.indexOf(10)) !== -1) {
-                                if (end > 256_000)
-                                    throw new Error("Provider event exceeded the allowed size");
-                                const line = pending.subarray(0, end).toString("utf8").replace(/\r$/, "");
-                                pending = pending.subarray(end + 1);
-                                yield line;
+                        while (true) {
+                            if (failure)
+                                throw failure;
+                            const line = lines.shift();
+                            if (line) {
+                                queuedBytes -= line.bytes;
+                                yield line.text;
+                                continue;
                             }
-                            if (pending.length > 256_000)
-                                throw new Error("Provider event exceeded the allowed size");
+                            if (finished)
+                                break;
+                            await new Promise(resolve => { wake = resolve; });
                         }
-                        if (pending.length)
-                            yield pending.toString("utf8");
-                        if (failure)
-                            throw failure;
                     }
                     finally {
+                        lines.length = 0;
+                        queuedBytes = 0;
                         kill();
                     }
                 } },
             kill: (signal) => kill((signal ?? "SIGKILL")),
-            once: (_event, callback) => { child.once("exit", callback); },
+            once: (_event, callback) => { if (termination) {
+                const ended = termination;
+                queueMicrotask(() => callback(ended.code, ended.signal));
+            }
+            else
+                exitCallbacks.push(callback); },
         };
     }
 }

package/dist/src/safety/codex-manual-controller.js

@@ -25,8 +25,10 @@ export function createManualPilotController(input, deps) {
     const claim = structuredClone(input.claim), releases = structuredClone(deps?.releases ?? CODEX_EXEC_RELEASES), readLocal = deps?.readLocal, now = deps?.now ?? Date.now;
     const account = path.resolve(input.codexHome ?? path.join(input.home, '.codex'));
     let used = false, closed = false, manual, host;
-    const close = async () => { closed = true; manual?.revoke(); await host?.close(); };
-    return Object.freeze({ close, async prepare() {
+    const queryAbort = new AbortController();
+    const cancel = () => { closed = true; queryAbort.abort(); manual?.revoke(); };
+    const close = async () => { cancel(); await host?.close(); };
+    return Object.freeze({ close, cancel, async prepare() {
             if (used || closed)
                 throw rejected();
             used = true;
@@ -65,7 +67,7 @@ export function createManualPilotController(input, deps) {
                 if (closed)
                     throw rejected();
                 stage = 'codex_manual_inventory';
-                const inventory = await (deps?.collectInventory ?? createManualProfileQuery().collectOnce)();
+                const inventory = await (deps?.collectInventory ?? createManualProfileQuery().collectOnce)(queryAbort.signal);
                 if (closed)
                     throw rejected();
                 stage = 'codex_manual_policy_scope';

package/dist/src/safety/codex-manual-profile-query.js

@@ -1,30 +1,175 @@
 import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
 import { emptyProfileInventoryXml } from './codex-native-observation.js';
+import { executionError, executionFailure } from './execution-failure.js';
 const rejected = () => Error('CODEX_MANUAL_PROFILE_QUERY_REJECTED');
-/** Two fixed read-only commands, under one interactive administrator grant.
- * No user command, path, credential, profile write or persistent root process. */
-export const MANUAL_PROFILES_ARGUMENTS = Object.freeze(['-e', `set uid to do shell script "/usr/bin/id -u" with administrator privileges\nif uid is not "0" then error "Unexpected query identity"\nset inventory to do shell script "/usr/bin/profiles list -all -output stdout-xml" with administrator privileges\nreturn uid & linefeed & inventory`]);
-const exec = promisify(execFile);
-const nativeRun = async (binary, args) => exec(binary, [...args], { encoding: 'utf8', timeout: 60_000, maxBuffer: 1_048_576, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } });
-/** Instantiate only in the trusted foreground controller immediately before an
- * approved pilot, never in the unattended daemon probe. Metadata output only. */
+const AUTHENTICATED = 'MTEC_PROFILE_AUTHENTICATED_V1';
+const QUERY_TIMEOUT_MS = 60_000;
+const failureMarkers = Object.freeze({
+    MTEC_PROFILE_AUTH_CANCELLED: 'CODEX_MANUAL_AUTH_CANCELLED',
+    MTEC_PROFILE_AUTH_REJECTED: 'CODEX_MANUAL_AUTH_REJECTED',
+    MTEC_PROFILE_QUERY_TIMEOUT: 'CODEX_MANUAL_QUERY_TIMEOUT',
+    MTEC_PROFILE_QUERY_FAILED: 'CODEX_MANUAL_QUERY_COMMAND_FAILED',
+    MTEC_PROFILE_NONROOT: 'CODEX_MANUAL_QUERY_NONROOT',
+});
+const failure = (code) => executionError(rejected(), 'codex_manual_inventory', code);
+/** No Runner deadline while the employee is authenticating. The fixed first
+ * command acquires the grant; only then does the bounded read-only query start.
+ * No user commands, credential writes or persistent privileged process. */
+export const MANUAL_PROFILES_ARGUMENTS = Object.freeze(['-e', `with timeout of 2147483647 seconds
+ try
+  set uid to do shell script "/usr/bin/id -u" with administrator privileges
+ on error messageText number errorNumber
+  if errorNumber is -128 then
+   log "MTEC_PROFILE_AUTH_CANCELLED"
+  else
+   log "MTEC_PROFILE_AUTH_REJECTED"
+  end if
+  error "Administrator authentication failed" number 10001
+ end try
+ if uid is not "0" then
+  log "MTEC_PROFILE_NONROOT"
+  error "Unexpected query identity" number 10002
+ end if
+ log "MTEC_PROFILE_AUTHENTICATED_V1"
+ try
+  with timeout of 60 seconds
+   set inventory to do shell script "/usr/bin/profiles list -all -output stdout-xml" with administrator privileges
+  end timeout
+ on error messageText number errorNumber
+  if errorNumber is -1712 then
+   log "MTEC_PROFILE_QUERY_TIMEOUT"
+  else
+   log "MTEC_PROFILE_QUERY_FAILED"
+  end if
+  error "Profile inventory failed" number 10003
+ end try
+ return uid & linefeed & inventory
+end timeout`]);
+/** Injectable process seam, never a task-provided command. Protocol markers are
+ * fixed by our script; raw native stderr is discarded rather than published. */
+export function createManualProfileProcessRunner(start = execFile) {
+    return (binary, args, options) => new Promise((resolve, reject) => {
+        let pending = '', marked = false, reason, settled = false;
+        let child;
+        const finishError = (error) => { if (settled)
+            return; settled = true; reject(error); };
+        try {
+            child = start(binary, [...args], { encoding: 'utf8', timeout: 0, maxBuffer: 1_048_576, signal: options.signal, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } }, (error, stdout, stderr) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (error) {
+                    reject(reason ? failure(reason) : executionError(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED'));
+                    return;
+                }
+                if (reason) {
+                    reject(failure(reason));
+                    return;
+                }
+                if (!marked) {
+                    reject(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                    return;
+                }
+                const rest = String(stderr).split(/\r?\n/).filter(line => line !== AUTHENTICATED && line !== '').join('\n');
+                resolve({ stdout: String(stdout), stderr: rest });
+            });
+            child.stderr?.on('data', (chunk) => {
+                if (settled)
+                    return;
+                pending += chunk.toString();
+                if (pending.length > 1_048_576) {
+                    finishError(failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID'));
+                    child?.kill();
+                    return;
+                }
+                let end;
+                while ((end = pending.indexOf('\n')) !== -1) {
+                    const line = pending.slice(0, end).replace(/\r$/, '');
+                    pending = pending.slice(end + 1);
+                    if (Object.hasOwn(failureMarkers, line))
+                        reason = failureMarkers[line];
+                    if (line === AUTHENTICATED) {
+                        if (marked) {
+                            finishError(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                            child?.kill();
+                            return;
+                        }
+                        marked = true;
+                        try {
+                            options.onAuthenticated();
+                        }
+                        catch {
+                            finishError(failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID'));
+                            child?.kill();
+                            return;
+                        }
+                    }
+                }
+            });
+        }
+        catch (error) {
+            finishError(executionError(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED'));
+        }
+    });
+}
+const nativeRun = createManualProfileProcessRunner();
+/** Foreground-only, single-use, cancellable. Human authentication wait is not
+ * query age: evidence is stamped when the bounded inventory actually finishes. */
 export function createManualProfileQuery(input) {
     const run = input?.run ?? nativeRun, now = input?.now ?? Date.now;
     let used = false;
-    return Object.freeze({ async collectOnce() {
+    return Object.freeze({ async collectOnce(signal) {
             if (used)
-                throw rejected();
+                throw failure('CODEX_MANUAL_QUERY_REUSED');
             used = true;
+            const controller = new AbortController();
+            let timer;
+            let firstFailure, authenticatedAt;
+            const abort = (code) => { firstFailure ??= failure(code); controller.abort(); };
+            const externalAbort = () => abort('CODEX_MANUAL_QUERY_ABORTED');
+            signal?.addEventListener('abort', externalAbort, { once: true });
             try {
-                const startedAt = now(), result = await run('/usr/bin/osascript', MANUAL_PROFILES_ARGUMENTS), observedAt = now();
-                if (!Number.isSafeInteger(startedAt) || startedAt < 0 || !Number.isSafeInteger(observedAt) || observedAt < startedAt || observedAt - startedAt > 60_000 || result.stderr !== '' || typeof result.stdout !== 'string' || !result.stdout.startsWith('0\n') || !emptyProfileInventoryXml(result.stdout.slice(2)))
-                    throw rejected();
+                if (signal?.aborted) {
+                    externalAbort();
+                    throw firstFailure;
+                }
+                const startedAt = now();
+                if (!Number.isSafeInteger(startedAt) || startedAt < 0)
+                    throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                // Reject independently of whether an injected/native runner settles on abort.
+                const cancelled = new Promise((_, reject) => { controller.signal.addEventListener('abort', () => reject(firstFailure), { once: true }); });
+                const operation = run('/usr/bin/osascript', MANUAL_PROFILES_ARGUMENTS, { signal: controller.signal, onAuthenticated() {
+                        if (controller.signal.aborted || authenticatedAt !== undefined)
+                            throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                        authenticatedAt = now();
+                        if (!Number.isSafeInteger(authenticatedAt) || authenticatedAt < startedAt)
+                            throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                        timer = setTimeout(() => abort('CODEX_MANUAL_QUERY_TIMEOUT'), QUERY_TIMEOUT_MS);
+                    } });
+                const result = await Promise.race([operation, cancelled]), observedAt = now();
+                if (firstFailure)
+                    throw firstFailure;
+                if (authenticatedAt === undefined || !Number.isSafeInteger(observedAt) || observedAt < authenticatedAt)
+                    throw failure('CODEX_MANUAL_QUERY_PROTOCOL_INVALID');
+                if (observedAt - authenticatedAt > QUERY_TIMEOUT_MS)
+                    throw failure('CODEX_MANUAL_QUERY_TIMEOUT');
+                if (typeof result.stdout !== 'string' || result.stderr !== '' || !result.stdout.includes('\n'))
+                    throw failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID');
+                if (!result.stdout.startsWith('0\n'))
+                    throw failure('CODEX_MANUAL_QUERY_NONROOT');
+                if (!emptyProfileInventoryXml(result.stdout.slice(2)))
+                    throw failure('CODEX_MANUAL_QUERY_OUTPUT_INVALID');
                 return Object.freeze({ version: 1, exit: 0, euid: 0, scope: 'machine_and_current_user', complete: true, empty: true, observedAt, inventoryFingerprint: createHash('sha256').update(result.stdout.slice(2)).digest('hex') });
             }
-            catch {
-                throw rejected();
+            catch (error) {
+                const diagnostic = executionFailure(error, 'codex_manual_inventory', 'CODEX_MANUAL_QUERY_COMMAND_FAILED');
+                throw firstFailure ?? executionError(error, 'codex_manual_inventory', diagnostic.code);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+                signal?.removeEventListener('abort', externalAbort);
             }
         } });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "private": false,
   "license": "UNLICENSED",
   "bin": {