mtech-ai-local-runner 0.1.21 → 0.1.23

package/README.md

@@ -10,6 +10,33 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.23: separate progress from the final report
+
+Codex receives native-message instructions: optional progress is plain text and
+the structured completed/blocked report is emitted once at the end. The Runner
+derives lifecycle events; Codex is no longer asked to author normalized progress
+or checkpoint events. Claude's existing instructions are unchanged.
+
+Strict report uniqueness and final-message validation remain in force. Fake
+tests reproduce the observed multiple-report failure, but do not prove why the
+historical model emitted three reports or guarantee future model compliance.
+Publication and foreground installation do not rerun Codex or update the daemon.
+
+## 0.1.22: completion report classification and terminal diagnostics
+
+Report validation distinguishes missing messages, zero valid reports, multiple
+valid reports, an invalid final message and an incomplete turn. Runtime events
+and terminal Job results retain only fixed codes and consistent message/report
+counts, never raw provider output. Structured blocked reports use the same
+bounded single-fence envelope rules as completed reports and remain blocked.
+
+Exactly one valid final report and successful turn completion remain required;
+multiple reports are never picked or merged. Existing evidence, scope, identity,
+cancellation and unlimited admitted employee work remain unchanged. Earlier
+0.1.21 report failure cannot be reclassified without its missing original
+counts. Publication and foreground installation do not update the daemon or
+rerun Codex. See [completion report validation](https://bitbucket.org/mtechbal/api-cloud-service-ai-gateway/src/development/docs/ai-ops-gateway/codex-completion-report-validation.md).
+
 ## 0.1.21: exclude personal history from isolated job startup
 
 The job-only Codex wrapper denies reads of the original account's `sessions`

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,6 +1,6 @@
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never a reason to try another path. If required work cannot proceed, return the structured blocked report.`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never a reason to try another path. If required work cannot proceed, return the structured blocked report.`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/adapters/codex/stream-parser.js

@@ -1,19 +1,13 @@
-import { completionEvent } from "../completion-report.js";
+import { completionEnvelope, completionEvent } from "../completion-report.js";
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value)
         ? value : undefined;
 }
 function finalReport(text) {
     const complete = completionEvent(text);
-    if (complete.eventType === "completed" || typeof text !== "string" || text.length > 16_000)
+    if (complete.eventType === "completed")
         return complete;
-    let value;
-    try {
-        value = record(JSON.parse(text));
-    }
-    catch {
-        return complete;
-    }
+    const value = completionEnvelope(text);
     const bounded = (v, size) => typeof v === "string" && v.trim().length > 0 && v.length <= size;
     const entries = (v, min) => Array.isArray(v) && v.length >= min && v.length <= 20 && v.every(item => bounded(item, 500));
     if (!value || Object.keys(value).some(key => !["status", "report", "evidence", "pending_work"].includes(key))
@@ -26,6 +20,7 @@ function finalReport(text) {
 export class CodexStreamParser {
     stopped = false;
     report;
+    messages = 0;
     candidates = 0;
     parse(line) {
         if (this.stopped)
@@ -53,15 +48,21 @@ export class CodexStreamParser {
                 return this.finish({ eventType: "scope_conflict", summary: "Codex emitted a native tool operation outside the job bridge" });
             }
             if (event.type === "item.completed" && item.type === "agent_message") {
-                this.report = item.text;
-                if (["completed", "blocked"].includes(finalReport(item.text).eventType))
+                this.messages += 1;
+                this.report = finalReport(item.text);
+                if (["completed", "blocked"].includes(this.report.eventType))
                     this.candidates += 1;
             }
         }
         if (event.type !== "turn.completed")
             return [];
-        const terminal = this.candidates === 1 ? finalReport(this.report)
-            : { eventType: "failed", summary: "Codex did not return one unambiguous completion report" };
+        // Keep final-message validity and uniqueness independent. Never select an
+        // earlier report over an invalid final message, or pick between two reports.
+        const terminal = this.candidates === 0
+            ? this.reportFailure(this.messages === 0 ? "CODEX_COMPLETION_REPORT_MISSING" : "CODEX_COMPLETION_REPORT_INVALID")
+            : this.candidates > 1 ? this.reportFailure("CODEX_COMPLETION_REPORT_MULTIPLE")
+                : this.report && ["completed", "blocked"].includes(this.report.eventType) ? this.report
+                    : this.reportFailure("CODEX_COMPLETION_REPORT_NOT_FINAL");
         const usage = record(event.usage);
         const observed = {};
         for (const field of ["input_tokens", "cached_input_tokens", "output_tokens"]) {
@@ -75,7 +76,20 @@ export class CodexStreamParser {
         return this.finish(terminal);
     }
     end() {
-        return this.stopped ? [] : this.finish({ eventType: "failed", summary: "Codex ended without a validated completion report" });
+        return this.stopped ? [] : this.finish(this.reportFailure("CODEX_TURN_INCOMPLETE"));
+    }
+    reportFailure(code) {
+        const summaries = {
+            CODEX_COMPLETION_REPORT_MISSING: "Codex returned no completed agent message",
+            CODEX_COMPLETION_REPORT_INVALID: "Codex returned no valid completion report",
+            CODEX_COMPLETION_REPORT_MULTIPLE: "Codex returned multiple valid completion reports",
+            CODEX_COMPLETION_REPORT_NOT_FINAL: "Codex's final message was not the unique valid completion report",
+            CODEX_TURN_INCOMPLETE: "Codex ended before successful turn completion",
+        };
+        return { eventType: "failed", summary: summaries[code], payload: { completion_report: {
+                    version: "codex-completion-report-v1", code, agent_message_count: this.messages,
+                    valid_report_count: this.candidates, invalid_message_count: this.messages - this.candidates,
+                } } };
     }
     finish(event) {
         this.stopped = true;

package/dist/src/adapters/completion-report.js

@@ -2,6 +2,24 @@ import { MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 const MAX_EVIDENCE_ITEMS = 20;
 const MAX_EVIDENCE_CHARS = 500;
 const MAX_REPORT_ENVELOPE_CHARS = 16_000;
+const REPORT_FAILURE_CODES = ["CODEX_COMPLETION_REPORT_MISSING", "CODEX_COMPLETION_REPORT_INVALID", "CODEX_COMPLETION_REPORT_MULTIPLE", "CODEX_COMPLETION_REPORT_NOT_FINAL", "CODEX_TURN_INCOMPLETE"];
+/** Diagnostic metadata only, never completion authority. Copy no provider text. */
+export function completionReportDiagnostic(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const d = value, code = d.code;
+    const messages = d.agent_message_count, valid = d.valid_report_count, invalid = d.invalid_message_count;
+    if (d.version !== "codex-completion-report-v1" || typeof code !== "string" || !REPORT_FAILURE_CODES.includes(code)
+        || typeof messages !== "number" || !Number.isSafeInteger(messages) || messages < 0
+        || typeof valid !== "number" || !Number.isSafeInteger(valid) || valid < 0 || valid > messages
+        || typeof invalid !== "number" || !Number.isSafeInteger(invalid) || invalid !== messages - valid
+        || code === "CODEX_COMPLETION_REPORT_MISSING" && messages !== 0
+        || code === "CODEX_COMPLETION_REPORT_INVALID" && (messages === 0 || valid !== 0)
+        || code === "CODEX_COMPLETION_REPORT_MULTIPLE" && valid < 2
+        || code === "CODEX_COMPLETION_REPORT_NOT_FINAL" && (valid !== 1 || invalid === 0))
+        return undefined;
+    return { version: "codex-completion-report-v1", code, agent_message_count: messages, valid_report_count: valid, invalid_message_count: invalid };
+}
 export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the available tools; do not delegate or start background work. " +
     "Do not report completed while waiting for results, tests, or another agent. " +
     "Your final response must be one JSON object, without Markdown fences: " +
@@ -15,40 +33,43 @@ export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the
 function boundedText(value, max) {
     return typeof value === "string" && value.trim().length > 0 && value.length <= max;
 }
-/** Validate the full final result before truncation; never publish malformed/interim output. */
-export function completionEvent(result, costUsd) {
-    const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
-        ? { cost_usd: costUsd }
-        : {};
-    const failed = {
-        eventType: "failed",
-        summary: "completion report is missing, incomplete or invalid",
-        payload: usage,
-    };
+/** Decode bounded framing only. Callers must still validate status and evidence. */
+export function completionEnvelope(result) {
     if (typeof result !== "string" || result.length > MAX_REPORT_ENVELOPE_CHARS)
-        return failed;
+        return undefined;
     let report;
     try {
         report = JSON.parse(result);
     }
     catch {
-        // Claude may wrap the final report in one Markdown fence after a short
-        // explanation. Accept framing only; retain every completion/evidence check.
         if ((result.match(/```/g) ?? []).length !== 2)
-            return failed;
+            return undefined;
         const framed = result.trim().match(/^(?:[\s\S]*?\n)?```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n```$/);
         if (!framed)
-            return failed;
+            return undefined;
         try {
             report = JSON.parse(framed[1]);
         }
         catch {
-            return failed;
+            return undefined;
         }
     }
-    if (!report || typeof report !== "object" || Array.isArray(report))
+    return report && typeof report === "object" && !Array.isArray(report)
+        ? report : undefined;
+}
+/** Validate the full final result before truncation; never publish malformed/interim output. */
+export function completionEvent(result, costUsd) {
+    const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
+        ? { cost_usd: costUsd }
+        : {};
+    const failed = {
+        eventType: "failed",
+        summary: "completion report is missing, incomplete or invalid",
+        payload: usage,
+    };
+    const value = completionEnvelope(result);
+    if (!value)
         return failed;
-    const value = report;
     if (Object.keys(value).some((key) => !["status", "report", "evidence", "pending_work"].includes(key))
         || value.status !== "completed"
         || !boundedText(value.report, MAX_EVENT_SUMMARY_CHARS)

package/dist/src/adapters/prompt-compiler.js

@@ -4,6 +4,11 @@ const STOP_BEFORE_PUBLICATION_RULE = "Stop before publication. Never run git com
 const EVENT_SCHEMA_NOTICE = "Report progress only through the normalized event lifecycle (started, progress, file_changed, question, " +
     "test_started, test_result, budget_warning, checkpoint_ready, blocked, completed, failed). " +
     "Checkpoint your work with checkpoint_ready before stopping whenever it is safe to do so.";
+const NATIVE_PROGRESS_NOTICE = "The Runner derives lifecycle events from the native CLI stream; do not author normalized lifecycle or checkpoint events. " +
+    "If progress commentary is needed, use brief plain text, not the completion-report schema. " +
+    "Do not emit report-shaped JSON in commentary or progress messages. " +
+    "Emit the structured completion report exactly once, as your final response after all available work and checks. " +
+    "Do not repeat, preview, revise or re-emit a completed or blocked report. If blocked, stop work and emit that one final blocked report.";
 function requiredArray(value, label) {
     if (!Array.isArray(value)) {
         throw new Error(`task package is missing ${label}`);
@@ -53,7 +58,9 @@ export function compilePrompt(taskPackage, options) {
         `## Required tests\n${requiredTests.map((item) => `- ${item}`).join("\n")}`,
         `## Prohibited actions\n${prohibitedActions.map((item) => `- ${item}`).join("\n")}`,
         `## Stop-before-publication rule\n${STOP_BEFORE_PUBLICATION_RULE}`,
-        `## Event and checkpoint obligations\n${EVENT_SCHEMA_NOTICE}`,
+        options.progressReporting === "native_messages"
+            ? `## Native progress and terminal reporting\n${NATIVE_PROGRESS_NOTICE}`
+            : `## Event and checkpoint obligations\n${EVENT_SCHEMA_NOTICE}`,
         `## Final completion report\n${COMPLETION_REPORT_NOTICE}`,
     ];
     return sections.join("\n\n");

package/dist/src/daemon/execution-coordinator.js

@@ -2,6 +2,7 @@ import { executionError, executionFailure } from '../safety/execution-failure.js
 import { requireSecurityRequirements } from '../safety/security-requirements.js';
 import { GatewayToolError } from "../gateway-client.js";
 import { createHash } from "node:crypto";
+import { completionReportDiagnostic } from "../adapters/completion-report.js";
 import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 function canonical(value) {
     if (Array.isArray(value))
@@ -268,7 +269,8 @@ export class ExecutionCoordinator {
                 clearInterval(heartbeatTimer);
         }
         const status = terminal.eventType === "completed" ? "completed" : terminal.eventType === "cancelled" ? "cancelled" : terminal.eventType === "blocked" || terminal.eventType === "scope_conflict" ? "blocked" : "failed";
-        await this.deps.gateway.complete({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(adapter.securityReceipt?.() ? { security_receipt: adapter.securityReceipt() } : {}) } });
+        const reportDiagnostic = status === "failed" ? completionReportDiagnostic(terminal.payload?.completion_report) : undefined;
+        await this.deps.gateway.complete({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(adapter.securityReceipt?.() ? { security_receipt: adapter.securityReceipt() } : {}) } });
         await this.deps.state.clear();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "private": false,
   "license": "UNLICENSED",
   "bin": {