mtech-ai-local-runner 0.1.16 → 0.1.18

package/README.md

@@ -10,6 +10,34 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.18: preparation deadline enforcement
+
+The overall 30-second preparation budget also covers release inspection. A
+synchronous metadata check can delay JavaScript timer callbacks. Local guards
+now use a monotonic deadline after inspection and at spawn/input/admission
+boundaries, refusing expired preparation even when its timer has not run. The
+budget is not reset or extended; admitted employee work remains unbounded.
+Fake callbacks reproduce the late-admission defect. Existing 0.1.17 receipts do
+not contain phase timing, so this is not proof of the historical native wait's
+cause or successful real-account connectivity. No new native stack sampler,
+account operation, daemon change or actual CLI run is part of this correction.
+
+## 0.1.17: owned startup, pipe and transport observations
+
+An owned-process collector marker distinguishes available diagnostics from a
+missing collector. Fixed observations separate spawn, stdin write/end requests,
+OS pipe finish, stdout/stderr activity/EOF, selected JSON event type names, exit,
+and MCP TCP connection from authenticated HTTP discovery. No event payload is
+copied into diagnostics. Pipe finish does **not** prove the CLI consumed stdin;
+TCP activity does **not** prove the connection belongs to Codex or authorize tools.
+Provider event type observations are not attestations of policy or model use.
+The legacy `Reading prompt from stdin...` marker is not emitted for forced
+`exec -` input in the inspected release source; its absence cannot locate a wait.
+Failure snapshots are captured before owned cleanup. Existing preparation limits,
+actual employee task limits, credentials, permissions and tool gates are unchanged.
+This is local diagnostic coverage, not proof of the previous account failure's
+cause or a successful real-account run. No automatic stack sampler is enabled.
+
 ## 0.1.16: bounded startup and MCP failure observations
 
 Failed Codex preparation now preserves fixed native error markers and separates

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,4 @@
+import { performance } from 'node:perf_hooks';
 import { localEndpointObservations } from '../../safety/local-tool-server.js';
 import { processStartupObservations } from '../../process/node-process-group-host.js';
 import { executionError } from '../../safety/execution-failure.js';
@@ -10,6 +11,7 @@ import { officialExecObservationLimits } from './exec-observer.js';
 import { EXEC_GATES, assessExecPreflight, requireExecHandshake } from './exec-preflight.js';
 import { EXEC_MODE, isReleaseExecMode, EXEC_TRANSPORT, assertOfficialExecPlanAvailable, claimOfficialExecPlan, requireOfficialExecPlan } from './exec-invocation.js';
 const fail = () => new Error('CODEX_EXEC_PREFLIGHT_REJECTED');
+const PREPARATION_TIMEOUT_MS = 30_000;
 /** No default native inspector, handshake observer or OS process host is created.
  * Missing per-execution evidence blocks before spawn. Synthetic callbacks grant
  * only the fake host used by tests, never a compiled production release entry. */
@@ -69,17 +71,26 @@ export class CodexExecLaunchHost {
         const mcpDetail = () => stage === 'codex_mcp' ? this.deps.execTools?.discoveryDetail() : undefined;
         const observations = () => { const invocation = requireOfficialExecPlan(this.plan); return [...(this.handle ? processStartupObservations(this.handle) : []), ...localEndpointObservations(this.plan.endpoint, invocation.env.AI_GATEWAY_JOB_MCP_TOKEN)]; };
         const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail(), observations()); };
+        // Timer callbacks cannot interrupt synchronous native metadata checks. Keep
+        // the same total budget and enforce it at effect boundaries with a monotonic
+        // clock, rather than spawning/submitting after an already expired inspection.
+        const deadline = performance.now() + PREPARATION_TIMEOUT_MS;
+        const assertPreparationBudget = () => { if (performance.now() >= deadline) {
+            interrupt('CODEX_EXEC_PREPARATION_TIMEOUT');
+            throw interruption;
+        } };
         let timer, external;
         try {
             this.assertContext(ctx, jobId);
             requireOfficialExecPlan(this.plan);
             if (typeof prompt !== 'string' || !prompt || prompt.length > 1_000_000 || signal?.aborted)
                 throw fail();
-            const stopped = new Promise((_, reject) => { external = () => { interrupt('CODEX_EXEC_ABORTED'); void this.cancel().catch(() => { }); reject(interruption); }; this.abort.signal.addEventListener('abort', () => reject(interruption ?? fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(() => { interrupt('CODEX_EXEC_PREPARATION_TIMEOUT'); external(); }, 30_000); });
+            const stopped = new Promise((_, reject) => { external = () => { interrupt('CODEX_EXEC_ABORTED'); void this.cancel().catch(() => { }); reject(interruption); }; this.abort.signal.addEventListener('abort', () => reject(interruption ?? fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(() => { interrupt('CODEX_EXEC_PREPARATION_TIMEOUT'); external(); }, PREPARATION_TIMEOUT_MS); });
             const preparation = (async () => {
                 const supported = isReleaseExecMode(this.plan.mode);
                 stage = 'codex_inspection';
                 this.inspection = await (supported ? this.deps.inspectRelease?.(this.plan, this.abort.signal) : this.deps.inspect?.(this.plan, this.abort.signal));
+                assertPreparationBudget();
                 const assessment = supported ? assessReleaseExec(this.inspection?.snapshot, this.plan) : assessExecPreflight(this.inspection?.snapshot, this.plan);
                 if (!supported && !this.deps.inspect)
                     assessment.reasonCodes.push(...officialExecObservationLimits());
@@ -92,7 +103,9 @@ export class CodexExecLaunchHost {
                 const manual = ctx.approvedTaskPackage?.security_requirements?.mdm_verification === 'manual_prelaunch';
                 if (manual && typeof this.inspection.beforeSpawn !== 'function')
                     throw fail();
+                assertPreparationBudget();
                 this.inspection.beforeSpawn?.();
+                assertPreparationBudget();
                 stage = 'codex_spawn';
                 const h = this.deps.processHost.spawn(invocation.binary, invocation.args, { cwd: this.plan.cwd, env: invocation.env });
                 this.handle = h;
@@ -115,6 +128,7 @@ export class CodexExecLaunchHost {
                     void this.cancel().catch(() => { });
                 });
                 this.current();
+                assertPreparationBudget();
                 if (supported) {
                     const gate = this.deps.execTools;
                     gate.bind(h, () => { try {
@@ -126,35 +140,48 @@ export class CodexExecLaunchHost {
                     } });
                     // Vendor exec consumes stdin before it can initialize its required MCP.
                     // Prompt submission may cause provider/account effects; do not call this no-model.
+                    assertPreparationBudget();
                     h.stdin.write(prompt);
                     this.current();
+                    assertPreparationBudget();
                     h.stdin.end();
                     this.current();
+                    assertPreparationBudget();
                     gate.promptSubmitted(h);
                     stage = 'codex_mcp';
                     const observed = await gate.wait(h, this.abort.signal);
                     this.current();
+                    assertPreparationBudget();
                     requireExecHandshake(observed, h, this.plan);
+                    assertPreparationBudget();
                     gate.authorize(h);
                     this.current();
+                    assertPreparationBudget();
                     requireExecHandshake(observed, h, this.plan);
+                    assertPreparationBudget();
                     this.receiptValue = Object.freeze({ receipt_version: this.plan.mode === UNMANAGED_EXEC_MODE ? 'cli-exec-job-security-receipt-v3' : 'cli-exec-job-security-receipt-v2', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: this.plan.mode, ...(this.plan.mode === UNMANAGED_EXEC_MODE ? { policy_scope: this.inspection.snapshot.policyScope } : {}), phase: 'post_prompt_mcp_authorized', policy_evidence: 'reviewed_release_and_current_inputs', mcp_evidence: 'authenticated_server_discovery', native_policy_observed: false, first_inference_observed: false, execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
                     return h;
                 }
                 const handshake = await this.deps.handshake?.(h, this.plan, this.abort.signal);
                 this.current();
+                assertPreparationBudget();
                 requireExecHandshake(handshake, h, this.plan);
                 this.handshake = handshake;
                 // An input hash is not a native effective-config certificate. Preserve the
                 // evidence origin in the audit receipt and never reuse AppServer authority.
                 const receipt = Object.freeze({ receipt_version: 'cli-exec-job-security-receipt-v1', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: EXEC_MODE, phase: 'exec_pre_prompt', execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
                 this.current();
+                assertPreparationBudget();
                 requireExecHandshake(handshake, h, this.plan);
+                assertPreparationBudget();
                 h.stdin.write(prompt);
                 this.current();
+                assertPreparationBudget();
                 h.stdin.end();
                 this.current();
+                assertPreparationBudget();
                 requireExecHandshake(handshake, h, this.plan);
+                assertPreparationBudget();
                 this.receiptValue = receipt;
                 return h;
             })();

package/dist/src/process/node-process-group-host.js

@@ -1,5 +1,5 @@
 const startup = new WeakMap();
-/** Fixed text observations from this owned host only. Never raw stderr or authority. */
+/** Fixed lifecycle/text observations from this owned host only. Never raw stderr or authority. */
 export function processStartupObservations(handle) { return [...(startup.get(handle) ?? [])]; }
 import { spawn } from "node:child_process";
 /** Each invocation owns one new process group; no name-based process sweeping. */
@@ -8,6 +8,9 @@ export class NodeProcessGroupHost {
         if (process.platform !== "darwin")
             throw new Error("Codex process isolation requires macOS");
         const child = spawn(command, args, { ...options, shell: false, detached: true, stdio: ["pipe", "pipe", "pipe"] });
+        const observations = new Set(['host_observer_v2']);
+        child.once('spawn', () => observations.add('host_process_spawned'));
+        child.stdin.once('finish', () => observations.add('host_stdin_finished'));
         let failure;
         let owned = true;
         let finished = false, consumed = false, queuedBytes = 0, wake;
@@ -44,8 +47,9 @@ export class NodeProcessGroupHost {
             if (signal === "SIGKILL")
                 owned = false;
         };
-        child.on("error", () => { failure ??= new Error("Provider process could not start"); terminated(null, null); notify(); });
+        child.on("error", () => { observations.add('host_process_spawn_failed'); failure ??= new Error("Provider process could not start"); terminated(null, null); notify(); });
         child.stdin.on("error", () => {
+            observations.add('host_stdin_failed');
             failure ??= new Error("Provider process input closed");
             try {
                 kill();
@@ -58,8 +62,9 @@ export class NodeProcessGroupHost {
         });
         // Keep fixed observations and fixed marker prefixes only: no raw stderr,
         // account text, paths or URLs survive a data callback, even for split chunks.
-        const observations = new Set();
         const markers = [
+            // Legacy wording appears only with implicit piped stdin, NOT forced `exec -`.
+            // Its absence cannot locate startup; pipe finish does not prove native consumption.
             { name: 'native_stdin_read', text: 'Reading prompt from stdin...', prefix: '' },
             { name: 'native_model_catalog_failed', text: 'codex_models_manager::manager: failed to refresh available models:', prefix: '' },
             { name: 'native_cloud_policy_failed', text: 'Failed to fetch cloud config bundle', prefix: '' },
@@ -71,6 +76,7 @@ export class NodeProcessGroupHost {
             { name: 'native_auth_refresh_unsupported', text: 'chatgpt auth token refresh is not supported in exec mode', prefix: '' },
         ];
         child.stderr.on('data', (chunk) => {
+            observations.add('host_stderr_data');
             const data = chunk.toString('utf8');
             for (const marker of markers) {
                 if (observations.has(marker.name))
@@ -90,9 +96,10 @@ export class NodeProcessGroupHost {
                 }
             }
         });
-        child.stderr.once('end', () => { for (const marker of markers)
+        child.stderr.once('end', () => { observations.add('host_stderr_ended'); for (const marker of markers)
             marker.prefix = ''; });
         child.once("exit", (code, signal) => {
+            observations.add('host_process_exited');
             try {
                 kill();
             }
@@ -111,12 +118,25 @@ export class NodeProcessGroupHost {
                     throw new Error("Provider event exceeded the allowed size");
                 if (queuedBytes + line.length + 1 > MAX_QUEUED_BYTES || lines.length >= MAX_QUEUED_LINES)
                     throw new Error("Provider event buffer exceeded the allowed size");
+                observations.add('host_stdout_line');
+                // Diagnostic type names only; no event payload, IDs, text or provider error.
+                try {
+                    const event = JSON.parse(line.toString('utf8'));
+                    const types = {
+                        'thread.started': 'host_event_thread_started', 'turn.started': 'host_event_turn_started',
+                        'turn.completed': 'host_event_turn_completed', 'turn.failed': 'host_event_turn_failed', 'error': 'host_event_error',
+                    };
+                    if (event && typeof event === 'object' && 'type' in event && typeof event.type === 'string' && Object.hasOwn(types, event.type))
+                        observations.add(types[event.type]);
+                }
+                catch { /* Malformed or unrelated output has no diagnostic authority. */ }
                 lines.push({ text: line.toString('utf8').replace(/\r$/, ''), bytes: line.length + 1 });
                 queuedBytes += line.length + 1;
                 notify();
             };
             try {
                 for await (const chunk of child.stdout) {
+                    observations.add('host_stdout_data');
                     pending = Buffer.concat([pending, Buffer.from(chunk)]);
                     let end;
                     while ((end = pending.indexOf(10)) !== -1) {
@@ -128,6 +148,7 @@ export class NodeProcessGroupHost {
                 }
                 if (pending.length)
                     enqueue(pending);
+                observations.add('host_stdout_ended');
             }
             catch (error) {
                 failure ??= error instanceof Error && ['Provider event exceeded the allowed size', 'Provider event buffer exceeded the allowed size'].includes(error.message) ? error : new Error('Provider event stream failed');
@@ -144,7 +165,7 @@ export class NodeProcessGroupHost {
             }
         })();
         const handle = {
-            stdin: { write: (text) => { child.stdin.write(text); }, end: () => { child.stdin.end(); } },
+            stdin: { write: (text) => { observations.add('host_stdin_write_requested'); child.stdin.write(text); }, end: () => { observations.add('host_stdin_end_requested'); child.stdin.end(); } },
             stdout: { async *[Symbol.asyncIterator]() {
                     if (consumed)
                         throw new Error('Provider event stream already consumed');

package/dist/src/safety/execution-failure.js

@@ -1,6 +1,15 @@
 import { GatewayToolError } from '../gateway-client.js';
 /** Observations only: provider text cannot authorize a tool or certify a cause. */
-export const STARTUP_OBSERVATIONS = Object.freeze(['native_stdin_read', 'native_model_catalog_failed', 'native_cloud_policy_failed', 'native_cloud_policy_timeout', 'native_required_mcp_failed', 'native_config_failed', 'native_auth_refresh_unsupported', 'local_mcp_request_received', 'local_mcp_auth_rejected', 'local_mcp_origin_or_host_rejected', 'local_mcp_initialize_received']);
+export const STARTUP_OBSERVATIONS = Object.freeze([
+    'host_observer_v2', 'host_process_spawned', 'host_process_spawn_failed', 'host_process_exited',
+    'host_stdin_write_requested', 'host_stdin_end_requested', 'host_stdin_finished', 'host_stdin_failed',
+    'host_stdout_data', 'host_stdout_line', 'host_stdout_ended', 'host_stderr_data', 'host_stderr_ended',
+    'host_event_thread_started', 'host_event_turn_started', 'host_event_turn_completed', 'host_event_turn_failed', 'host_event_error',
+    'local_mcp_tcp_connected',
+    'native_stdin_read', 'native_model_catalog_failed', 'native_cloud_policy_failed', 'native_cloud_policy_timeout',
+    'native_required_mcp_failed', 'native_config_failed', 'native_auth_refresh_unsupported',
+    'local_mcp_request_received', 'local_mcp_auth_rejected', 'local_mcp_origin_or_host_rejected', 'local_mcp_initialize_received',
+]);
 const issued = new WeakMap();
 export function executionFailure(error, stage, fallback = 'EXECUTION_FAILED') {
     if (error && typeof error === 'object') {

package/dist/src/safety/local-tool-server.js

@@ -189,6 +189,8 @@ export class LocalToolServer {
                 reply(400, { error: 'Invalid request' });
             }
         });
+        // Transport activity is not authenticated MCP discovery or tool authority.
+        this.server.on('connection', () => this.observations.add('local_mcp_tcp_connected'));
         this.server.requestTimeout = 15000;
         this.server.headersTimeout = 10000;
         this.starting = new Promise((resolve, reject) => { this.server.once('error', reject); this.server.listen(0, '127.0.0.1', () => resolve()); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "private": false,
   "license": "UNLICENSED",
   "bin": {