mtech-ai-local-runner 0.1.17 → 0.1.18

package/README.md

@@ -10,6 +10,18 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.18: preparation deadline enforcement
+
+The overall 30-second preparation budget also covers release inspection. A
+synchronous metadata check can delay JavaScript timer callbacks. Local guards
+now use a monotonic deadline after inspection and at spawn/input/admission
+boundaries, refusing expired preparation even when its timer has not run. The
+budget is not reset or extended; admitted employee work remains unbounded.
+Fake callbacks reproduce the late-admission defect. Existing 0.1.17 receipts do
+not contain phase timing, so this is not proof of the historical native wait's
+cause or successful real-account connectivity. No new native stack sampler,
+account operation, daemon change or actual CLI run is part of this correction.
+
 ## 0.1.17: owned startup, pipe and transport observations
 
 An owned-process collector marker distinguishes available diagnostics from a

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,4 @@
+import { performance } from 'node:perf_hooks';
 import { localEndpointObservations } from '../../safety/local-tool-server.js';
 import { processStartupObservations } from '../../process/node-process-group-host.js';
 import { executionError } from '../../safety/execution-failure.js';
@@ -10,6 +11,7 @@ import { officialExecObservationLimits } from './exec-observer.js';
 import { EXEC_GATES, assessExecPreflight, requireExecHandshake } from './exec-preflight.js';
 import { EXEC_MODE, isReleaseExecMode, EXEC_TRANSPORT, assertOfficialExecPlanAvailable, claimOfficialExecPlan, requireOfficialExecPlan } from './exec-invocation.js';
 const fail = () => new Error('CODEX_EXEC_PREFLIGHT_REJECTED');
+const PREPARATION_TIMEOUT_MS = 30_000;
 /** No default native inspector, handshake observer or OS process host is created.
  * Missing per-execution evidence blocks before spawn. Synthetic callbacks grant
  * only the fake host used by tests, never a compiled production release entry. */
@@ -69,17 +71,26 @@ export class CodexExecLaunchHost {
         const mcpDetail = () => stage === 'codex_mcp' ? this.deps.execTools?.discoveryDetail() : undefined;
         const observations = () => { const invocation = requireOfficialExecPlan(this.plan); return [...(this.handle ? processStartupObservations(this.handle) : []), ...localEndpointObservations(this.plan.endpoint, invocation.env.AI_GATEWAY_JOB_MCP_TOKEN)]; };
         const interrupt = (code) => { interruption ??= executionError(fail(), stage, code, mcpDetail(), observations()); };
+        // Timer callbacks cannot interrupt synchronous native metadata checks. Keep
+        // the same total budget and enforce it at effect boundaries with a monotonic
+        // clock, rather than spawning/submitting after an already expired inspection.
+        const deadline = performance.now() + PREPARATION_TIMEOUT_MS;
+        const assertPreparationBudget = () => { if (performance.now() >= deadline) {
+            interrupt('CODEX_EXEC_PREPARATION_TIMEOUT');
+            throw interruption;
+        } };
         let timer, external;
         try {
             this.assertContext(ctx, jobId);
             requireOfficialExecPlan(this.plan);
             if (typeof prompt !== 'string' || !prompt || prompt.length > 1_000_000 || signal?.aborted)
                 throw fail();
-            const stopped = new Promise((_, reject) => { external = () => { interrupt('CODEX_EXEC_ABORTED'); void this.cancel().catch(() => { }); reject(interruption); }; this.abort.signal.addEventListener('abort', () => reject(interruption ?? fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(() => { interrupt('CODEX_EXEC_PREPARATION_TIMEOUT'); external(); }, 30_000); });
+            const stopped = new Promise((_, reject) => { external = () => { interrupt('CODEX_EXEC_ABORTED'); void this.cancel().catch(() => { }); reject(interruption); }; this.abort.signal.addEventListener('abort', () => reject(interruption ?? fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(() => { interrupt('CODEX_EXEC_PREPARATION_TIMEOUT'); external(); }, PREPARATION_TIMEOUT_MS); });
             const preparation = (async () => {
                 const supported = isReleaseExecMode(this.plan.mode);
                 stage = 'codex_inspection';
                 this.inspection = await (supported ? this.deps.inspectRelease?.(this.plan, this.abort.signal) : this.deps.inspect?.(this.plan, this.abort.signal));
+                assertPreparationBudget();
                 const assessment = supported ? assessReleaseExec(this.inspection?.snapshot, this.plan) : assessExecPreflight(this.inspection?.snapshot, this.plan);
                 if (!supported && !this.deps.inspect)
                     assessment.reasonCodes.push(...officialExecObservationLimits());
@@ -92,7 +103,9 @@ export class CodexExecLaunchHost {
                 const manual = ctx.approvedTaskPackage?.security_requirements?.mdm_verification === 'manual_prelaunch';
                 if (manual && typeof this.inspection.beforeSpawn !== 'function')
                     throw fail();
+                assertPreparationBudget();
                 this.inspection.beforeSpawn?.();
+                assertPreparationBudget();
                 stage = 'codex_spawn';
                 const h = this.deps.processHost.spawn(invocation.binary, invocation.args, { cwd: this.plan.cwd, env: invocation.env });
                 this.handle = h;
@@ -115,6 +128,7 @@ export class CodexExecLaunchHost {
                     void this.cancel().catch(() => { });
                 });
                 this.current();
+                assertPreparationBudget();
                 if (supported) {
                     const gate = this.deps.execTools;
                     gate.bind(h, () => { try {
@@ -126,35 +140,48 @@ export class CodexExecLaunchHost {
                     } });
                     // Vendor exec consumes stdin before it can initialize its required MCP.
                     // Prompt submission may cause provider/account effects; do not call this no-model.
+                    assertPreparationBudget();
                     h.stdin.write(prompt);
                     this.current();
+                    assertPreparationBudget();
                     h.stdin.end();
                     this.current();
+                    assertPreparationBudget();
                     gate.promptSubmitted(h);
                     stage = 'codex_mcp';
                     const observed = await gate.wait(h, this.abort.signal);
                     this.current();
+                    assertPreparationBudget();
                     requireExecHandshake(observed, h, this.plan);
+                    assertPreparationBudget();
                     gate.authorize(h);
                     this.current();
+                    assertPreparationBudget();
                     requireExecHandshake(observed, h, this.plan);
+                    assertPreparationBudget();
                     this.receiptValue = Object.freeze({ receipt_version: this.plan.mode === UNMANAGED_EXEC_MODE ? 'cli-exec-job-security-receipt-v3' : 'cli-exec-job-security-receipt-v2', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: this.plan.mode, ...(this.plan.mode === UNMANAGED_EXEC_MODE ? { policy_scope: this.inspection.snapshot.policyScope } : {}), phase: 'post_prompt_mcp_authorized', policy_evidence: 'reviewed_release_and_current_inputs', mcp_evidence: 'authenticated_server_discovery', native_policy_observed: false, first_inference_observed: false, execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
                     return h;
                 }
                 const handshake = await this.deps.handshake?.(h, this.plan, this.abort.signal);
                 this.current();
+                assertPreparationBudget();
                 requireExecHandshake(handshake, h, this.plan);
                 this.handshake = handshake;
                 // An input hash is not a native effective-config certificate. Preserve the
                 // evidence origin in the audit receipt and never reuse AppServer authority.
                 const receipt = Object.freeze({ receipt_version: 'cli-exec-job-security-receipt-v1', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: EXEC_MODE, phase: 'exec_pre_prompt', execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
                 this.current();
+                assertPreparationBudget();
                 requireExecHandshake(handshake, h, this.plan);
+                assertPreparationBudget();
                 h.stdin.write(prompt);
                 this.current();
+                assertPreparationBudget();
                 h.stdin.end();
                 this.current();
+                assertPreparationBudget();
                 requireExecHandshake(handshake, h, this.plan);
+                assertPreparationBudget();
                 this.receiptValue = receipt;
                 return h;
             })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "private": false,
   "license": "UNLICENSED",
   "bin": {