mtech-ai-local-runner 0.1.15 → 0.1.16

package/README.md

@@ -10,6 +10,21 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.16: bounded startup and MCP failure observations
+
+Failed Codex preparation now preserves fixed native error markers and separates
+local MCP request arrival, rejected credentials/Origin/Host, and authenticated
+initialize receipt. Raw stderr, tokens, request bodies, paths and URLs are not
+included. Observations do not authorize tools, attest native policy, or prove a
+root cause. A missing successful initialize response does not prove that the
+client sent no HTTP request. Existing trusted failure stages/codes remain intact,
+including when new observations are added to an already classified gate error.
+
+This patch fixes diagnostic evidence loss. It does not establish successful
+real-account MCP connectivity, change permissions/deadlines/task limits, update
+the daemon, or authorize another actual model attempt. Publication and verified
+foreground installation are separate from a subsequently approved execution.
+
 ## 0.1.15: startup output before MCP readiness
 
 The process host drains stdout from spawn, before the adapter starts consuming

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,5 @@
+import { localEndpointObservations } from '../../safety/local-tool-server.js';
+import { processStartupObservations } from '../../process/node-process-group-host.js';
 import { executionError } from '../../safety/execution-failure.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
 import { fingerprint as taskFingerprint } from '../../daemon/execution-coordinator.js';
@@ -65,7 +67,8 @@ export class CodexExecLaunchHost {
         let stage = 'codex_context';
         let interruption;
         const mcpDetail = () => stage === 'codex_mcp' ? this.deps.execTools?.discoveryDetail() : undefined;
-        const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail()); };
+        const observations = () => { const invocation = requireOfficialExecPlan(this.plan); return [...(this.handle ? processStartupObservations(this.handle) : []), ...localEndpointObservations(this.plan.endpoint, invocation.env.AI_GATEWAY_JOB_MCP_TOKEN)]; };
+        const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail(), observations()); };
         let timer, external;
         try {
             this.assertContext(ctx, jobId);
@@ -158,7 +161,7 @@ export class CodexExecLaunchHost {
             return await Promise.race([preparation, stopped]);
         }
         catch (error) {
-            const safe = executionError(interruption ?? error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED', mcpDetail());
+            const safe = executionError(interruption ?? error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED', mcpDetail(), observations());
             await this.cancel().catch(() => { });
             throw safe;
         }

package/dist/src/process/node-process-group-host.js

@@ -1,3 +1,6 @@
+const startup = new WeakMap();
+/** Fixed text observations from this owned host only. Never raw stderr or authority. */
+export function processStartupObservations(handle) { return [...(startup.get(handle) ?? [])]; }
 import { spawn } from "node:child_process";
 /** Each invocation owns one new process group; no name-based process sweeping. */
 export class NodeProcessGroupHost {
@@ -53,8 +56,42 @@ export class NodeProcessGroupHost {
             terminated(null, null);
             notify();
         });
-        // Provider stderr can contain account details. Consume without publishing it.
-        child.stderr.resume();
+        // Keep fixed observations and fixed marker prefixes only: no raw stderr,
+        // account text, paths or URLs survive a data callback, even for split chunks.
+        const observations = new Set();
+        const markers = [
+            { name: 'native_stdin_read', text: 'Reading prompt from stdin...', prefix: '' },
+            { name: 'native_model_catalog_failed', text: 'codex_models_manager::manager: failed to refresh available models:', prefix: '' },
+            { name: 'native_cloud_policy_failed', text: 'Failed to fetch cloud config bundle', prefix: '' },
+            { name: 'native_cloud_policy_failed', text: 'Failed to load cloud config bundle', prefix: '' },
+            { name: 'native_cloud_policy_timeout', text: 'Timed out waiting for cloud config bundle after ', prefix: '' },
+            { name: 'native_cloud_policy_timeout', text: 'timed out waiting for cloud config bundle after ', prefix: '' },
+            { name: 'native_required_mcp_failed', text: 'required MCP servers failed to initialize: ai_local:', prefix: '' },
+            { name: 'native_config_failed', text: 'Error loading config:', prefix: '' },
+            { name: 'native_auth_refresh_unsupported', text: 'chatgpt auth token refresh is not supported in exec mode', prefix: '' },
+        ];
+        child.stderr.on('data', (chunk) => {
+            const data = chunk.toString('utf8');
+            for (const marker of markers) {
+                if (observations.has(marker.name))
+                    continue;
+                const text = marker.prefix + data;
+                marker.prefix = '';
+                if (text.includes(marker.text)) {
+                    observations.add(marker.name);
+                    continue;
+                }
+                for (let n = Math.min(text.length, marker.text.length - 1); n > 0; n--) {
+                    const fixed = marker.text.slice(0, n);
+                    if (text.endsWith(fixed)) {
+                        marker.prefix = fixed;
+                        break;
+                    }
+                }
+            }
+        });
+        child.stderr.once('end', () => { for (const marker of markers)
+            marker.prefix = ''; });
         child.once("exit", (code, signal) => {
             try {
                 kill();
@@ -106,7 +143,7 @@ export class NodeProcessGroupHost {
                 notify();
             }
         })();
-        return {
+        const handle = {
             stdin: { write: (text) => { child.stdin.write(text); }, end: () => { child.stdin.end(); } },
             stdout: { async *[Symbol.asyncIterator]() {
                     if (consumed)
@@ -141,5 +178,7 @@ export class NodeProcessGroupHost {
             else
                 exitCallbacks.push(callback); },
         };
+        startup.set(handle, observations);
+        return handle;
     }
 }

package/dist/src/safety/execution-failure.js

@@ -1,10 +1,12 @@
 import { GatewayToolError } from '../gateway-client.js';
+/** Observations only: provider text cannot authorize a tool or certify a cause. */
+export const STARTUP_OBSERVATIONS = Object.freeze(['native_stdin_read', 'native_model_catalog_failed', 'native_cloud_policy_failed', 'native_cloud_policy_timeout', 'native_required_mcp_failed', 'native_config_failed', 'native_auth_refresh_unsupported', 'local_mcp_request_received', 'local_mcp_auth_rejected', 'local_mcp_origin_or_host_rejected', 'local_mcp_initialize_received']);
 const issued = new WeakMap();
 export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     if (error && typeof error === 'object') {
         const trusted = issued.get(error);
         if (trusted)
-            return { ...trusted };
+            return { ...trusted, ...(trusted.observations ? { observations: [...trusted.observations] } : {}) };
         try {
             if (error instanceof GatewayToolError && (error.code === 'GATEWAY_TOOL_REJECTED' || error.code === 'GATEWAY_TRANSPORT_ERROR' || error.code === 'WORK_LOOP_CANCELLED')) {
                 return { stage, code: error.code };
@@ -24,12 +26,17 @@ export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     }
     return { stage, code: fallback };
 }
-export function executionError(error, stage, fallback, detail) {
+export function executionError(error, stage, fallback, detail, observations) {
     const diagnostic = executionFailure(error, stage, fallback);
     // Only trusted callers supply this fixed vocabulary. Serialized provider
     // errors, messages and stderr never become diagnostic authority.
     if (!issued.has(error) && ['mcp_initialize_missing', 'mcp_initialized_missing', 'mcp_inventory_missing', 'mcp_discovery_complete'].includes(detail))
         diagnostic.detail = detail;
+    if (Array.isArray(observations)) {
+        const fixed = STARTUP_OBSERVATIONS.filter(value => diagnostic.observations?.includes(value) || observations.includes(value));
+        if (fixed.length)
+            diagnostic.observations = fixed;
+    }
     const safe = new Error(fallback);
     issued.set(safe, Object.freeze(diagnostic));
     return safe;

package/dist/src/safety/local-tool-server.js

@@ -8,6 +8,12 @@ export function localDiscoveryScopeMatches(scope, endpoint, token) {
     const data = discoveryScopes.get(scope);
     return !!data && data.endpoint === endpoint && data.credentialHash === createHash('sha256').update(token).digest('hex');
 }
+// Bounded diagnostic metadata; possession grants neither discovery nor tool authority.
+const endpointObservations = new Map();
+export function localEndpointObservations(url, token) {
+    const record = endpointObservations.get(url);
+    return record?.credentialHash === createHash('sha256').update(token).digest('hex') ? [...record.values] : [];
+}
 const MAX_BODY = 1024 * 1024;
 const schemas = {
     local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
@@ -22,6 +28,7 @@ export function localToolInventory() {
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {
     options;
+    observations = new Set();
     server = null;
     revoked = false;
     starting = null;
@@ -57,6 +64,7 @@ export class LocalToolServer {
             throw new Error('Local tool server already started');
         this.token = randomBytes(32).toString('hex');
         this.server = createServer(async (req, res) => {
+            this.observations.add('local_mcp_request_received');
             const reply = (status, body) => {
                 if (res.writableEnded)
                     return;
@@ -72,11 +80,13 @@ export class LocalToolServer {
                 return;
             }
             if (req.headers.origin !== undefined || req.headers.host !== new URL(this.url).host) {
+                this.observations.add('local_mcp_origin_or_host_rejected');
                 reply(403, { error: 'Forbidden' });
                 return;
             }
             const token = this.token, expected = Buffer.from(token ? `Bearer ${token}` : ''), supplied = Buffer.from(req.headers.authorization ?? '');
             if (!token || expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) {
+                this.observations.add('local_mcp_auth_rejected');
                 reply(401, { error: 'Unauthorized' });
                 return;
             }
@@ -128,6 +138,7 @@ export class LocalToolServer {
                 }
                 const send = (result) => reply(200, { jsonrpc: '2.0', id: rpc.id, result });
                 if (rpc.method === 'initialize') {
+                    this.observations.add('local_mcp_initialize_received');
                     res.once('finish', () => { if (!this.revoked)
                         this.observe('initialize_response'); });
                     send({ protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'runner-local-tools', version: '1' } });
@@ -190,10 +201,13 @@ export class LocalToolServer {
         if (!address || typeof address === 'string')
             throw new Error('Failed to bind local tool server');
         this.url = `http://127.0.0.1:${address.port}/mcp`;
+        endpointObservations.set(this.url, { credentialHash: createHash('sha256').update(this.token).digest('hex'), values: this.observations });
         discoveryScopes.set(this.discoveryScope, { endpoint: this.url, credentialHash: createHash('sha256').update(this.token).digest('hex') });
         return { url: this.url, token: this.token };
     }
     async close() {
+        if (this.url)
+            endpointObservations.delete(this.url);
         this.revoke();
         const server = this.server;
         this.server = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "private": false,
   "license": "UNLICENSED",
   "bin": {