mtech-ai-local-runner 0.1.15 → 0.1.17

package/README.md

@@ -10,6 +10,37 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.17: owned startup, pipe and transport observations
+
+An owned-process collector marker distinguishes available diagnostics from a
+missing collector. Fixed observations separate spawn, stdin write/end requests,
+OS pipe finish, stdout/stderr activity/EOF, selected JSON event type names, exit,
+and MCP TCP connection from authenticated HTTP discovery. No event payload is
+copied into diagnostics. Pipe finish does **not** prove the CLI consumed stdin;
+TCP activity does **not** prove the connection belongs to Codex or authorize tools.
+Provider event type observations are not attestations of policy or model use.
+The legacy `Reading prompt from stdin...` marker is not emitted for forced
+`exec -` input in the inspected release source; its absence cannot locate a wait.
+Failure snapshots are captured before owned cleanup. Existing preparation limits,
+actual employee task limits, credentials, permissions and tool gates are unchanged.
+This is local diagnostic coverage, not proof of the previous account failure's
+cause or a successful real-account run. No automatic stack sampler is enabled.
+
+## 0.1.16: bounded startup and MCP failure observations
+
+Failed Codex preparation now preserves fixed native error markers and separates
+local MCP request arrival, rejected credentials/Origin/Host, and authenticated
+initialize receipt. Raw stderr, tokens, request bodies, paths and URLs are not
+included. Observations do not authorize tools, attest native policy, or prove a
+root cause. A missing successful initialize response does not prove that the
+client sent no HTTP request. Existing trusted failure stages/codes remain intact,
+including when new observations are added to an already classified gate error.
+
+This patch fixes diagnostic evidence loss. It does not establish successful
+real-account MCP connectivity, change permissions/deadlines/task limits, update
+the daemon, or authorize another actual model attempt. Publication and verified
+foreground installation are separate from a subsequently approved execution.
+
 ## 0.1.15: startup output before MCP readiness
 
 The process host drains stdout from spawn, before the adapter starts consuming

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,5 @@
+import { localEndpointObservations } from '../../safety/local-tool-server.js';
+import { processStartupObservations } from '../../process/node-process-group-host.js';
 import { executionError } from '../../safety/execution-failure.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
 import { fingerprint as taskFingerprint } from '../../daemon/execution-coordinator.js';
@@ -65,7 +67,8 @@ export class CodexExecLaunchHost {
         let stage = 'codex_context';
         let interruption;
         const mcpDetail = () => stage === 'codex_mcp' ? this.deps.execTools?.discoveryDetail() : undefined;
-        const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail()); };
+        const observations = () => { const invocation = requireOfficialExecPlan(this.plan); return [...(this.handle ? processStartupObservations(this.handle) : []), ...localEndpointObservations(this.plan.endpoint, invocation.env.AI_GATEWAY_JOB_MCP_TOKEN)]; };
+        const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail(), observations()); };
         let timer, external;
         try {
             this.assertContext(ctx, jobId);
@@ -158,7 +161,7 @@ export class CodexExecLaunchHost {
             return await Promise.race([preparation, stopped]);
         }
         catch (error) {
-            const safe = executionError(interruption ?? error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED', mcpDetail());
+            const safe = executionError(interruption ?? error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED', mcpDetail(), observations());
             await this.cancel().catch(() => { });
             throw safe;
         }

package/dist/src/process/node-process-group-host.js

@@ -1,3 +1,6 @@
+const startup = new WeakMap();
+/** Fixed lifecycle/text observations from this owned host only. Never raw stderr or authority. */
+export function processStartupObservations(handle) { return [...(startup.get(handle) ?? [])]; }
 import { spawn } from "node:child_process";
 /** Each invocation owns one new process group; no name-based process sweeping. */
 export class NodeProcessGroupHost {
@@ -5,6 +8,9 @@ export class NodeProcessGroupHost {
         if (process.platform !== "darwin")
             throw new Error("Codex process isolation requires macOS");
         const child = spawn(command, args, { ...options, shell: false, detached: true, stdio: ["pipe", "pipe", "pipe"] });
+        const observations = new Set(['host_observer_v2']);
+        child.once('spawn', () => observations.add('host_process_spawned'));
+        child.stdin.once('finish', () => observations.add('host_stdin_finished'));
         let failure;
         let owned = true;
         let finished = false, consumed = false, queuedBytes = 0, wake;
@@ -41,8 +47,9 @@ export class NodeProcessGroupHost {
             if (signal === "SIGKILL")
                 owned = false;
         };
-        child.on("error", () => { failure ??= new Error("Provider process could not start"); terminated(null, null); notify(); });
+        child.on("error", () => { observations.add('host_process_spawn_failed'); failure ??= new Error("Provider process could not start"); terminated(null, null); notify(); });
         child.stdin.on("error", () => {
+            observations.add('host_stdin_failed');
             failure ??= new Error("Provider process input closed");
             try {
                 kill();
@@ -53,9 +60,46 @@ export class NodeProcessGroupHost {
             terminated(null, null);
             notify();
         });
-        // Provider stderr can contain account details. Consume without publishing it.
-        child.stderr.resume();
+        // Keep fixed observations and fixed marker prefixes only: no raw stderr,
+        // account text, paths or URLs survive a data callback, even for split chunks.
+        const markers = [
+            // Legacy wording appears only with implicit piped stdin, NOT forced `exec -`.
+            // Its absence cannot locate startup; pipe finish does not prove native consumption.
+            { name: 'native_stdin_read', text: 'Reading prompt from stdin...', prefix: '' },
+            { name: 'native_model_catalog_failed', text: 'codex_models_manager::manager: failed to refresh available models:', prefix: '' },
+            { name: 'native_cloud_policy_failed', text: 'Failed to fetch cloud config bundle', prefix: '' },
+            { name: 'native_cloud_policy_failed', text: 'Failed to load cloud config bundle', prefix: '' },
+            { name: 'native_cloud_policy_timeout', text: 'Timed out waiting for cloud config bundle after ', prefix: '' },
+            { name: 'native_cloud_policy_timeout', text: 'timed out waiting for cloud config bundle after ', prefix: '' },
+            { name: 'native_required_mcp_failed', text: 'required MCP servers failed to initialize: ai_local:', prefix: '' },
+            { name: 'native_config_failed', text: 'Error loading config:', prefix: '' },
+            { name: 'native_auth_refresh_unsupported', text: 'chatgpt auth token refresh is not supported in exec mode', prefix: '' },
+        ];
+        child.stderr.on('data', (chunk) => {
+            observations.add('host_stderr_data');
+            const data = chunk.toString('utf8');
+            for (const marker of markers) {
+                if (observations.has(marker.name))
+                    continue;
+                const text = marker.prefix + data;
+                marker.prefix = '';
+                if (text.includes(marker.text)) {
+                    observations.add(marker.name);
+                    continue;
+                }
+                for (let n = Math.min(text.length, marker.text.length - 1); n > 0; n--) {
+                    const fixed = marker.text.slice(0, n);
+                    if (text.endsWith(fixed)) {
+                        marker.prefix = fixed;
+                        break;
+                    }
+                }
+            }
+        });
+        child.stderr.once('end', () => { observations.add('host_stderr_ended'); for (const marker of markers)
+            marker.prefix = ''; });
         child.once("exit", (code, signal) => {
+            observations.add('host_process_exited');
             try {
                 kill();
             }
@@ -74,12 +118,25 @@ export class NodeProcessGroupHost {
                     throw new Error("Provider event exceeded the allowed size");
                 if (queuedBytes + line.length + 1 > MAX_QUEUED_BYTES || lines.length >= MAX_QUEUED_LINES)
                     throw new Error("Provider event buffer exceeded the allowed size");
+                observations.add('host_stdout_line');
+                // Diagnostic type names only; no event payload, IDs, text or provider error.
+                try {
+                    const event = JSON.parse(line.toString('utf8'));
+                    const types = {
+                        'thread.started': 'host_event_thread_started', 'turn.started': 'host_event_turn_started',
+                        'turn.completed': 'host_event_turn_completed', 'turn.failed': 'host_event_turn_failed', 'error': 'host_event_error',
+                    };
+                    if (event && typeof event === 'object' && 'type' in event && typeof event.type === 'string' && Object.hasOwn(types, event.type))
+                        observations.add(types[event.type]);
+                }
+                catch { /* Malformed or unrelated output has no diagnostic authority. */ }
                 lines.push({ text: line.toString('utf8').replace(/\r$/, ''), bytes: line.length + 1 });
                 queuedBytes += line.length + 1;
                 notify();
             };
             try {
                 for await (const chunk of child.stdout) {
+                    observations.add('host_stdout_data');
                     pending = Buffer.concat([pending, Buffer.from(chunk)]);
                     let end;
                     while ((end = pending.indexOf(10)) !== -1) {
@@ -91,6 +148,7 @@ export class NodeProcessGroupHost {
                 }
                 if (pending.length)
                     enqueue(pending);
+                observations.add('host_stdout_ended');
             }
             catch (error) {
                 failure ??= error instanceof Error && ['Provider event exceeded the allowed size', 'Provider event buffer exceeded the allowed size'].includes(error.message) ? error : new Error('Provider event stream failed');
@@ -106,8 +164,8 @@ export class NodeProcessGroupHost {
                 notify();
             }
         })();
-        return {
-            stdin: { write: (text) => { child.stdin.write(text); }, end: () => { child.stdin.end(); } },
+        const handle = {
+            stdin: { write: (text) => { observations.add('host_stdin_write_requested'); child.stdin.write(text); }, end: () => { observations.add('host_stdin_end_requested'); child.stdin.end(); } },
             stdout: { async *[Symbol.asyncIterator]() {
                     if (consumed)
                         throw new Error('Provider event stream already consumed');
@@ -141,5 +199,7 @@ export class NodeProcessGroupHost {
             else
                 exitCallbacks.push(callback); },
         };
+        startup.set(handle, observations);
+        return handle;
     }
 }

package/dist/src/safety/execution-failure.js

@@ -1,10 +1,21 @@
 import { GatewayToolError } from '../gateway-client.js';
+/** Observations only: provider text cannot authorize a tool or certify a cause. */
+export const STARTUP_OBSERVATIONS = Object.freeze([
+    'host_observer_v2', 'host_process_spawned', 'host_process_spawn_failed', 'host_process_exited',
+    'host_stdin_write_requested', 'host_stdin_end_requested', 'host_stdin_finished', 'host_stdin_failed',
+    'host_stdout_data', 'host_stdout_line', 'host_stdout_ended', 'host_stderr_data', 'host_stderr_ended',
+    'host_event_thread_started', 'host_event_turn_started', 'host_event_turn_completed', 'host_event_turn_failed', 'host_event_error',
+    'local_mcp_tcp_connected',
+    'native_stdin_read', 'native_model_catalog_failed', 'native_cloud_policy_failed', 'native_cloud_policy_timeout',
+    'native_required_mcp_failed', 'native_config_failed', 'native_auth_refresh_unsupported',
+    'local_mcp_request_received', 'local_mcp_auth_rejected', 'local_mcp_origin_or_host_rejected', 'local_mcp_initialize_received',
+]);
 const issued = new WeakMap();
 export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     if (error && typeof error === 'object') {
         const trusted = issued.get(error);
         if (trusted)
-            return { ...trusted };
+            return { ...trusted, ...(trusted.observations ? { observations: [...trusted.observations] } : {}) };
         try {
             if (error instanceof GatewayToolError && (error.code === 'GATEWAY_TOOL_REJECTED' || error.code === 'GATEWAY_TRANSPORT_ERROR' || error.code === 'WORK_LOOP_CANCELLED')) {
                 return { stage, code: error.code };
@@ -24,12 +35,17 @@ export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     }
     return { stage, code: fallback };
 }
-export function executionError(error, stage, fallback, detail) {
+export function executionError(error, stage, fallback, detail, observations) {
     const diagnostic = executionFailure(error, stage, fallback);
     // Only trusted callers supply this fixed vocabulary. Serialized provider
     // errors, messages and stderr never become diagnostic authority.
     if (!issued.has(error) && ['mcp_initialize_missing', 'mcp_initialized_missing', 'mcp_inventory_missing', 'mcp_discovery_complete'].includes(detail))
         diagnostic.detail = detail;
+    if (Array.isArray(observations)) {
+        const fixed = STARTUP_OBSERVATIONS.filter(value => diagnostic.observations?.includes(value) || observations.includes(value));
+        if (fixed.length)
+            diagnostic.observations = fixed;
+    }
     const safe = new Error(fallback);
     issued.set(safe, Object.freeze(diagnostic));
     return safe;

package/dist/src/safety/local-tool-server.js

@@ -8,6 +8,12 @@ export function localDiscoveryScopeMatches(scope, endpoint, token) {
     const data = discoveryScopes.get(scope);
     return !!data && data.endpoint === endpoint && data.credentialHash === createHash('sha256').update(token).digest('hex');
 }
+// Bounded diagnostic metadata; possession grants neither discovery nor tool authority.
+const endpointObservations = new Map();
+export function localEndpointObservations(url, token) {
+    const record = endpointObservations.get(url);
+    return record?.credentialHash === createHash('sha256').update(token).digest('hex') ? [...record.values] : [];
+}
 const MAX_BODY = 1024 * 1024;
 const schemas = {
     local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
@@ -22,6 +28,7 @@ export function localToolInventory() {
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {
     options;
+    observations = new Set();
     server = null;
     revoked = false;
     starting = null;
@@ -57,6 +64,7 @@ export class LocalToolServer {
             throw new Error('Local tool server already started');
         this.token = randomBytes(32).toString('hex');
         this.server = createServer(async (req, res) => {
+            this.observations.add('local_mcp_request_received');
             const reply = (status, body) => {
                 if (res.writableEnded)
                     return;
@@ -72,11 +80,13 @@ export class LocalToolServer {
                 return;
             }
             if (req.headers.origin !== undefined || req.headers.host !== new URL(this.url).host) {
+                this.observations.add('local_mcp_origin_or_host_rejected');
                 reply(403, { error: 'Forbidden' });
                 return;
             }
             const token = this.token, expected = Buffer.from(token ? `Bearer ${token}` : ''), supplied = Buffer.from(req.headers.authorization ?? '');
             if (!token || expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) {
+                this.observations.add('local_mcp_auth_rejected');
                 reply(401, { error: 'Unauthorized' });
                 return;
             }
@@ -128,6 +138,7 @@ export class LocalToolServer {
                 }
                 const send = (result) => reply(200, { jsonrpc: '2.0', id: rpc.id, result });
                 if (rpc.method === 'initialize') {
+                    this.observations.add('local_mcp_initialize_received');
                     res.once('finish', () => { if (!this.revoked)
                         this.observe('initialize_response'); });
                     send({ protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'runner-local-tools', version: '1' } });
@@ -178,6 +189,8 @@ export class LocalToolServer {
                 reply(400, { error: 'Invalid request' });
             }
         });
+        // Transport activity is not authenticated MCP discovery or tool authority.
+        this.server.on('connection', () => this.observations.add('local_mcp_tcp_connected'));
         this.server.requestTimeout = 15000;
         this.server.headersTimeout = 10000;
         this.starting = new Promise((resolve, reject) => { this.server.once('error', reject); this.server.listen(0, '127.0.0.1', () => resolve()); });
@@ -190,10 +203,13 @@ export class LocalToolServer {
         if (!address || typeof address === 'string')
             throw new Error('Failed to bind local tool server');
         this.url = `http://127.0.0.1:${address.port}/mcp`;
+        endpointObservations.set(this.url, { credentialHash: createHash('sha256').update(this.token).digest('hex'), values: this.observations });
         discoveryScopes.set(this.discoveryScope, { endpoint: this.url, credentialHash: createHash('sha256').update(this.token).digest('hex') });
         return { url: this.url, token: this.token };
     }
     async close() {
+        if (this.url)
+            endpointObservations.delete(this.url);
         this.revoke();
         const server = this.server;
         this.server = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "private": false,
   "license": "UNLICENSED",
   "bin": {