mtech-ai-local-runner 0.1.20 → 0.1.21

package/README.md

@@ -10,6 +10,21 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.21: exclude personal history from isolated job startup
+
+The job-only Codex wrapper denies reads of the original account's `sessions`
+and `archived_sessions`. A fresh private job database therefore cannot re-index
+unrelated personal rollouts before MCP startup. Existing CLI/login paths,
+personal settings, required authenticated MCP and unlimited admitted employee
+work remain unchanged. Nothing is removed from the original history.
+
+Pinned native fake-data comparison verified zero imported personal-history rows
+and successful MCP initialization with this restriction. Real-account no-model
+evidence remains partial because the private collector did not confirm its
+owned exit/cleanup; real model completion is not established. Publication and
+foreground installation do not update the daemon or authorize an execution.
+See [local host comparison](https://bitbucket.org/mtechbal/api-cloud-service-ai-gateway/src/development/docs/ai-ops-gateway/codex-local-host-comparison.md).
+
 ## 0.1.20: distinguish owned wrapper and target startup
 
 Add bounded, read-only process-name/state/wait hints for the exact owned

package/dist/src/adapters/codex/global-instructions.js

@@ -14,12 +14,22 @@ export function accountAncestorPaths(account) {
     }
     return Object.freeze(parents);
 }
+/** New job processes must not re-index unrelated interactive history into
+ * their fresh private SQLite DB. Login stays at the original account root. */
+export function personalHistoryReadDenial(account) {
+    accountAncestorPaths(account);
+    return '(deny file-read* ' + ['sessions', 'archived_sessions'].map(name => {
+        const root = JSON.stringify(path.join(account, name));
+        return `(literal ${root}) (subpath ${root})`;
+    }).join(' ') + ')';
+}
 /** Additional per-process denial, not a grant of authority or global policy edit.
  * file-read* is intentional: data-only denial permits a final symlink alias.
  * Ancestor symlink denials prevent a later account-directory redirect. */
 export function globalInstructionProfile(account) {
     const ancestors = accountAncestorPaths(account), literal = (p) => `(literal ${JSON.stringify(p)})`;
     const profile = '(version 1)(allow default)'
+        + personalHistoryReadDenial(account)
         + '(deny file-read* ' + ['AGENTS.md', 'AGENTS.override.md'].map(name => literal(path.join(account, name))).join(' ') + ')'
         + '(deny file-read* (require-all (vnode-type SYMLINK) (require-any ' + ancestors.map(literal).join(' ') + ')))';
     if (profile.length > 64000)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "private": false,
   "license": "UNLICENSED",
   "bin": {