mtech-ai-local-runner 0.1.14 → 0.1.16

package/README.md

@@ -10,6 +10,31 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.16: bounded startup and MCP failure observations
+
+Failed Codex preparation now preserves fixed native error markers and separates
+local MCP request arrival, rejected credentials/Origin/Host, and authenticated
+initialize receipt. Raw stderr, tokens, request bodies, paths and URLs are not
+included. Observations do not authorize tools, attest native policy, or prove a
+root cause. A missing successful initialize response does not prove that the
+client sent no HTTP request. Existing trusted failure stages/codes remain intact,
+including when new observations are added to an already classified gate error.
+
+This patch fixes diagnostic evidence loss. It does not establish successful
+real-account MCP connectivity, change permissions/deadlines/task limits, update
+the daemon, or authorize another actual model attempt. Publication and verified
+foreground installation are separate from a subsequently approved execution.
+
+## 0.1.15: startup output before MCP readiness
+
+The process host drains stdout from spawn, before the adapter starts consuming
+events after authenticated MCP discovery. A bounded queue prevents the child
+from blocking on ordinary startup output; overflow stops only its owned process
+group. This changes no tool permissions, preparation deadlines or task limits.
+Fake-process tests reproduce the defect, but do not prove the cause of a previous
+real-account failure or successful account/MCP acceptance. Publication and a
+foreground installation do not update the daemon or authorize a model run.
+
 ## 0.1.14: foreground administrator authentication wait
 
 The manual Codex pilot waits for administrator authentication before starting

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,5 @@
+import { localEndpointObservations } from '../../safety/local-tool-server.js';
+import { processStartupObservations } from '../../process/node-process-group-host.js';
 import { executionError } from '../../safety/execution-failure.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
 import { fingerprint as taskFingerprint } from '../../daemon/execution-coordinator.js';
@@ -65,7 +67,8 @@ export class CodexExecLaunchHost {
         let stage = 'codex_context';
         let interruption;
         const mcpDetail = () => stage === 'codex_mcp' ? this.deps.execTools?.discoveryDetail() : undefined;
-        const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail()); };
+        const observations = () => { const invocation = requireOfficialExecPlan(this.plan); return [...(this.handle ? processStartupObservations(this.handle) : []), ...localEndpointObservations(this.plan.endpoint, invocation.env.AI_GATEWAY_JOB_MCP_TOKEN)]; };
+        const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail(), observations()); };
         let timer, external;
         try {
             this.assertContext(ctx, jobId);
@@ -158,7 +161,7 @@ export class CodexExecLaunchHost {
             return await Promise.race([preparation, stopped]);
         }
         catch (error) {
-            const safe = executionError(interruption ?? error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED', mcpDetail());
+            const safe = executionError(interruption ?? error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED', mcpDetail(), observations());
             await this.cancel().catch(() => { });
             throw safe;
         }

package/dist/src/process/node-process-group-host.js

@@ -1,3 +1,6 @@
+const startup = new WeakMap();
+/** Fixed text observations from this owned host only. Never raw stderr or authority. */
+export function processStartupObservations(handle) { return [...(startup.get(handle) ?? [])]; }
 import { spawn } from "node:child_process";
 /** Each invocation owns one new process group; no name-based process sweeping. */
 export class NodeProcessGroupHost {
@@ -7,6 +10,19 @@ export class NodeProcessGroupHost {
         const child = spawn(command, args, { ...options, shell: false, detached: true, stdio: ["pipe", "pipe", "pipe"] });
         let failure;
         let owned = true;
+        let finished = false, consumed = false, queuedBytes = 0, wake;
+        const lines = [];
+        const MAX_QUEUED_BYTES = 1_048_576, MAX_QUEUED_LINES = 8192;
+        const notify = () => { const resolve = wake; wake = undefined; resolve?.(); };
+        let termination;
+        const exitCallbacks = [];
+        const terminated = (code, signal) => {
+            if (termination)
+                return;
+            termination = { code, signal };
+            for (const callback of exitCallbacks.splice(0))
+                callback(code, signal);
+        };
         const kill = (signal = "SIGKILL") => {
             if (!owned || !child.pid)
                 return;
@@ -28,47 +44,141 @@ export class NodeProcessGroupHost {
             if (signal === "SIGKILL")
                 owned = false;
         };
-        child.on("error", () => { failure = new Error("Provider process could not start"); });
-        child.stdin.on("error", () => { failure = new Error("Provider process input closed"); });
-        // Provider stderr can contain account details. Consume without publishing it.
-        child.stderr.resume();
-        child.once("exit", () => {
+        child.on("error", () => { failure ??= new Error("Provider process could not start"); terminated(null, null); notify(); });
+        child.stdin.on("error", () => {
+            failure ??= new Error("Provider process input closed");
+            try {
+                kill();
+            }
+            catch {
+                failure = new Error('Provider process group cleanup could not be confirmed');
+            }
+            terminated(null, null);
+            notify();
+        });
+        // Keep fixed observations and fixed marker prefixes only: no raw stderr,
+        // account text, paths or URLs survive a data callback, even for split chunks.
+        const observations = new Set();
+        const markers = [
+            { name: 'native_stdin_read', text: 'Reading prompt from stdin...', prefix: '' },
+            { name: 'native_model_catalog_failed', text: 'codex_models_manager::manager: failed to refresh available models:', prefix: '' },
+            { name: 'native_cloud_policy_failed', text: 'Failed to fetch cloud config bundle', prefix: '' },
+            { name: 'native_cloud_policy_failed', text: 'Failed to load cloud config bundle', prefix: '' },
+            { name: 'native_cloud_policy_timeout', text: 'Timed out waiting for cloud config bundle after ', prefix: '' },
+            { name: 'native_cloud_policy_timeout', text: 'timed out waiting for cloud config bundle after ', prefix: '' },
+            { name: 'native_required_mcp_failed', text: 'required MCP servers failed to initialize: ai_local:', prefix: '' },
+            { name: 'native_config_failed', text: 'Error loading config:', prefix: '' },
+            { name: 'native_auth_refresh_unsupported', text: 'chatgpt auth token refresh is not supported in exec mode', prefix: '' },
+        ];
+        child.stderr.on('data', (chunk) => {
+            const data = chunk.toString('utf8');
+            for (const marker of markers) {
+                if (observations.has(marker.name))
+                    continue;
+                const text = marker.prefix + data;
+                marker.prefix = '';
+                if (text.includes(marker.text)) {
+                    observations.add(marker.name);
+                    continue;
+                }
+                for (let n = Math.min(text.length, marker.text.length - 1); n > 0; n--) {
+                    const fixed = marker.text.slice(0, n);
+                    if (text.endsWith(fixed)) {
+                        marker.prefix = fixed;
+                        break;
+                    }
+                }
+            }
+        });
+        child.stderr.once('end', () => { for (const marker of markers)
+            marker.prefix = ''; });
+        child.once("exit", (code, signal) => {
             try {
                 kill();
             }
             catch {
                 failure = new Error("Provider process group cleanup could not be confirmed");
             }
+            terminated(code, signal);
         });
-        return {
+        // Drain from spawn, not from the first adapter event read: official exec can
+        // emit startup events before it initializes MCP, while the adapter awaits
+        // that initialization before consuming events. Bound the pre-consumer queue.
+        void (async () => {
+            let pending = Buffer.alloc(0);
+            const enqueue = (line) => {
+                if (line.length > 256_000)
+                    throw new Error("Provider event exceeded the allowed size");
+                if (queuedBytes + line.length + 1 > MAX_QUEUED_BYTES || lines.length >= MAX_QUEUED_LINES)
+                    throw new Error("Provider event buffer exceeded the allowed size");
+                lines.push({ text: line.toString('utf8').replace(/\r$/, ''), bytes: line.length + 1 });
+                queuedBytes += line.length + 1;
+                notify();
+            };
+            try {
+                for await (const chunk of child.stdout) {
+                    pending = Buffer.concat([pending, Buffer.from(chunk)]);
+                    let end;
+                    while ((end = pending.indexOf(10)) !== -1) {
+                        enqueue(pending.subarray(0, end));
+                        pending = pending.subarray(end + 1);
+                    }
+                    if (pending.length > 256_000)
+                        throw new Error("Provider event exceeded the allowed size");
+                }
+                if (pending.length)
+                    enqueue(pending);
+            }
+            catch (error) {
+                failure ??= error instanceof Error && ['Provider event exceeded the allowed size', 'Provider event buffer exceeded the allowed size'].includes(error.message) ? error : new Error('Provider event stream failed');
+                try {
+                    kill();
+                }
+                catch {
+                    failure = new Error('Provider process group cleanup could not be confirmed');
+                }
+            }
+            finally {
+                finished = true;
+                notify();
+            }
+        })();
+        const handle = {
             stdin: { write: (text) => { child.stdin.write(text); }, end: () => { child.stdin.end(); } },
             stdout: { async *[Symbol.asyncIterator]() {
-                    let pending = Buffer.alloc(0);
+                    if (consumed)
+                        throw new Error('Provider event stream already consumed');
+                    consumed = true;
                     try {
-                        for await (const chunk of child.stdout) {
-                            pending = Buffer.concat([pending, Buffer.from(chunk)]);
-                            let end;
-                            while ((end = pending.indexOf(10)) !== -1) {
-                                if (end > 256_000)
-                                    throw new Error("Provider event exceeded the allowed size");
-                                const line = pending.subarray(0, end).toString("utf8").replace(/\r$/, "");
-                                pending = pending.subarray(end + 1);
-                                yield line;
+                        while (true) {
+                            if (failure)
+                                throw failure;
+                            const line = lines.shift();
+                            if (line) {
+                                queuedBytes -= line.bytes;
+                                yield line.text;
+                                continue;
                             }
-                            if (pending.length > 256_000)
-                                throw new Error("Provider event exceeded the allowed size");
+                            if (finished)
+                                break;
+                            await new Promise(resolve => { wake = resolve; });
                         }
-                        if (pending.length)
-                            yield pending.toString("utf8");
-                        if (failure)
-                            throw failure;
                     }
                     finally {
+                        lines.length = 0;
+                        queuedBytes = 0;
                         kill();
                     }
                 } },
             kill: (signal) => kill((signal ?? "SIGKILL")),
-            once: (_event, callback) => { child.once("exit", callback); },
+            once: (_event, callback) => { if (termination) {
+                const ended = termination;
+                queueMicrotask(() => callback(ended.code, ended.signal));
+            }
+            else
+                exitCallbacks.push(callback); },
         };
+        startup.set(handle, observations);
+        return handle;
     }
 }

package/dist/src/safety/execution-failure.js

@@ -1,10 +1,12 @@
 import { GatewayToolError } from '../gateway-client.js';
+/** Observations only: provider text cannot authorize a tool or certify a cause. */
+export const STARTUP_OBSERVATIONS = Object.freeze(['native_stdin_read', 'native_model_catalog_failed', 'native_cloud_policy_failed', 'native_cloud_policy_timeout', 'native_required_mcp_failed', 'native_config_failed', 'native_auth_refresh_unsupported', 'local_mcp_request_received', 'local_mcp_auth_rejected', 'local_mcp_origin_or_host_rejected', 'local_mcp_initialize_received']);
 const issued = new WeakMap();
 export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     if (error && typeof error === 'object') {
         const trusted = issued.get(error);
         if (trusted)
-            return { ...trusted };
+            return { ...trusted, ...(trusted.observations ? { observations: [...trusted.observations] } : {}) };
         try {
             if (error instanceof GatewayToolError && (error.code === 'GATEWAY_TOOL_REJECTED' || error.code === 'GATEWAY_TRANSPORT_ERROR' || error.code === 'WORK_LOOP_CANCELLED')) {
                 return { stage, code: error.code };
@@ -24,12 +26,17 @@ export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     }
     return { stage, code: fallback };
 }
-export function executionError(error, stage, fallback, detail) {
+export function executionError(error, stage, fallback, detail, observations) {
     const diagnostic = executionFailure(error, stage, fallback);
     // Only trusted callers supply this fixed vocabulary. Serialized provider
     // errors, messages and stderr never become diagnostic authority.
     if (!issued.has(error) && ['mcp_initialize_missing', 'mcp_initialized_missing', 'mcp_inventory_missing', 'mcp_discovery_complete'].includes(detail))
         diagnostic.detail = detail;
+    if (Array.isArray(observations)) {
+        const fixed = STARTUP_OBSERVATIONS.filter(value => diagnostic.observations?.includes(value) || observations.includes(value));
+        if (fixed.length)
+            diagnostic.observations = fixed;
+    }
     const safe = new Error(fallback);
     issued.set(safe, Object.freeze(diagnostic));
     return safe;

package/dist/src/safety/local-tool-server.js

@@ -8,6 +8,12 @@ export function localDiscoveryScopeMatches(scope, endpoint, token) {
     const data = discoveryScopes.get(scope);
     return !!data && data.endpoint === endpoint && data.credentialHash === createHash('sha256').update(token).digest('hex');
 }
+// Bounded diagnostic metadata; possession grants neither discovery nor tool authority.
+const endpointObservations = new Map();
+export function localEndpointObservations(url, token) {
+    const record = endpointObservations.get(url);
+    return record?.credentialHash === createHash('sha256').update(token).digest('hex') ? [...record.values] : [];
+}
 const MAX_BODY = 1024 * 1024;
 const schemas = {
     local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
@@ -22,6 +28,7 @@ export function localToolInventory() {
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {
     options;
+    observations = new Set();
     server = null;
     revoked = false;
     starting = null;
@@ -57,6 +64,7 @@ export class LocalToolServer {
             throw new Error('Local tool server already started');
         this.token = randomBytes(32).toString('hex');
         this.server = createServer(async (req, res) => {
+            this.observations.add('local_mcp_request_received');
             const reply = (status, body) => {
                 if (res.writableEnded)
                     return;
@@ -72,11 +80,13 @@ export class LocalToolServer {
                 return;
             }
             if (req.headers.origin !== undefined || req.headers.host !== new URL(this.url).host) {
+                this.observations.add('local_mcp_origin_or_host_rejected');
                 reply(403, { error: 'Forbidden' });
                 return;
             }
             const token = this.token, expected = Buffer.from(token ? `Bearer ${token}` : ''), supplied = Buffer.from(req.headers.authorization ?? '');
             if (!token || expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) {
+                this.observations.add('local_mcp_auth_rejected');
                 reply(401, { error: 'Unauthorized' });
                 return;
             }
@@ -128,6 +138,7 @@ export class LocalToolServer {
                 }
                 const send = (result) => reply(200, { jsonrpc: '2.0', id: rpc.id, result });
                 if (rpc.method === 'initialize') {
+                    this.observations.add('local_mcp_initialize_received');
                     res.once('finish', () => { if (!this.revoked)
                         this.observe('initialize_response'); });
                     send({ protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'runner-local-tools', version: '1' } });
@@ -190,10 +201,13 @@ export class LocalToolServer {
         if (!address || typeof address === 'string')
             throw new Error('Failed to bind local tool server');
         this.url = `http://127.0.0.1:${address.port}/mcp`;
+        endpointObservations.set(this.url, { credentialHash: createHash('sha256').update(this.token).digest('hex'), values: this.observations });
         discoveryScopes.set(this.discoveryScope, { endpoint: this.url, credentialHash: createHash('sha256').update(this.token).digest('hex') });
         return { url: this.url, token: this.token };
     }
     async close() {
+        if (this.url)
+            endpointObservations.delete(this.url);
         this.revoke();
         const server = this.server;
         this.server = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "private": false,
   "license": "UNLICENSED",
   "bin": {