mtech-ai-local-runner 0.1.24 → 0.1.26

package/README.md

@@ -10,6 +10,25 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.26: compiled private-file denial compatibility
+
+The compiled `.env.*` blocked-path rule now denies that private-file family
+without rejecting unrelated scoped reads. Private files at all depths,
+read-only access and unsupported-pattern rejection remain enforced. Shared
+Claude/Codex policy and actual MCP fake-data regressions use the full compiled
+path combination. Foreground installation does not rerun Codex or update the
+daemon; actual document acceptance still requires a separately approved run.
+
+## 0.1.25: scoped reads and blocked diagnostics
+
+Codex receives explicit file-scoped ai_local read/search guidance; launch and
+Gateway reporting remain host duties. Valid blocked reports now retain bounded
+report counts and identity comparisons in events and terminal results. They
+remain blocked, and multiple reports still fail closed. Fake-data integration
+checks generated settings with the actual scoped server; native model-visible
+tool exposure still needs a separately approved actual attempt. Foreground
+installation does not run Codex or update the daemon.
+
 ## 0.1.24: bounded report identity diagnostics
 
 Failed report validation records pair counts for same/different wire item IDs

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,6 +1,6 @@
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never a reason to try another path. If required work cannot proceed, return the structured blocked report.`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "docs/example.md"}) or local_search({path: "docs/example.md", query: "text"}) with checkout-relative paths. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never a reason to try another path. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/adapters/codex/stream-parser.js

@@ -75,6 +75,11 @@ export class CodexStreamParser {
             : this.candidates > 1 ? this.reportFailure("CODEX_COMPLETION_REPORT_MULTIPLE")
                 : this.report && ["completed", "blocked"].includes(this.report.eventType) ? this.report
                     : this.reportFailure("CODEX_COMPLETION_REPORT_NOT_FINAL");
+        if (terminal.eventType === "blocked")
+            terminal.payload = { ...terminal.payload, completion_report: {
+                    version: "codex-completion-report-v1", code: "CODEX_COMPLETION_REPORT_BLOCKED", agent_message_count: this.messages,
+                    valid_report_count: this.candidates, invalid_message_count: this.messages - this.candidates, identity: this.reportIdentity(),
+                } };
         const usage = record(event.usage);
         const observed = {};
         for (const field of ["input_tokens", "cached_input_tokens", "output_tokens"]) {

package/dist/src/adapters/completion-report.js

@@ -3,6 +3,7 @@ const MAX_EVIDENCE_ITEMS = 20;
 const MAX_EVIDENCE_CHARS = 500;
 const MAX_REPORT_ENVELOPE_CHARS = 16_000;
 const REPORT_FAILURE_CODES = ["CODEX_COMPLETION_REPORT_MISSING", "CODEX_COMPLETION_REPORT_INVALID", "CODEX_COMPLETION_REPORT_MULTIPLE", "CODEX_COMPLETION_REPORT_NOT_FINAL", "CODEX_TURN_INCOMPLETE"];
+const REPORT_DIAGNOSTIC_CODES = [...REPORT_FAILURE_CODES, "CODEX_COMPLETION_REPORT_BLOCKED"];
 /** Pair counts only; no item IDs, text, stable digests or arbitrary keys. */
 function reportIdentityDiagnostic(value, valid) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -27,14 +28,15 @@ export function completionReportDiagnostic(value) {
         return undefined;
     const d = value, code = d.code;
     const messages = d.agent_message_count, valid = d.valid_report_count, invalid = d.invalid_message_count;
-    if (d.version !== "codex-completion-report-v1" || typeof code !== "string" || !REPORT_FAILURE_CODES.includes(code)
+    if (d.version !== "codex-completion-report-v1" || typeof code !== "string" || !REPORT_DIAGNOSTIC_CODES.includes(code)
         || typeof messages !== "number" || !Number.isSafeInteger(messages) || messages < 0
         || typeof valid !== "number" || !Number.isSafeInteger(valid) || valid < 0 || valid > messages
         || typeof invalid !== "number" || !Number.isSafeInteger(invalid) || invalid !== messages - valid
         || code === "CODEX_COMPLETION_REPORT_MISSING" && messages !== 0
         || code === "CODEX_COMPLETION_REPORT_INVALID" && (messages === 0 || valid !== 0)
         || code === "CODEX_COMPLETION_REPORT_MULTIPLE" && valid < 2
-        || code === "CODEX_COMPLETION_REPORT_NOT_FINAL" && (valid !== 1 || invalid === 0))
+        || code === "CODEX_COMPLETION_REPORT_NOT_FINAL" && (valid !== 1 || invalid === 0)
+        || code === "CODEX_COMPLETION_REPORT_BLOCKED" && valid !== 1)
         return undefined;
     const identity = reportIdentityDiagnostic(d.identity, valid);
     return { version: "codex-completion-report-v1", code, agent_message_count: messages, valid_report_count: valid, invalid_message_count: invalid,

package/dist/src/daemon/execution-coordinator.js

@@ -269,7 +269,9 @@ export class ExecutionCoordinator {
                 clearInterval(heartbeatTimer);
         }
         const status = terminal.eventType === "completed" ? "completed" : terminal.eventType === "cancelled" ? "cancelled" : terminal.eventType === "blocked" || terminal.eventType === "scope_conflict" ? "blocked" : "failed";
-        const reportDiagnostic = status === "failed" ? completionReportDiagnostic(terminal.payload?.completion_report) : undefined;
+        const diagnostic = status === "failed" || terminal.eventType === "blocked" ? completionReportDiagnostic(terminal.payload?.completion_report) : undefined;
+        const reportDiagnostic = diagnostic && (terminal.eventType === "blocked"
+            ? diagnostic.code === "CODEX_COMPLETION_REPORT_BLOCKED" : diagnostic.code !== "CODEX_COMPLETION_REPORT_BLOCKED") ? diagnostic : undefined;
         await this.deps.gateway.complete({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(adapter.securityReceipt?.() ? { security_receipt: adapter.securityReceipt() } : {}) } });
         await this.deps.state.clear();
     }

package/dist/src/safety/local-tool-policy.js

@@ -15,6 +15,13 @@ function scopePath(root, scope) {
         throw new Error('DENIED_UNSUPPORTED_SCOPE');
     return path.resolve(root, directory);
 }
+function blockedScopeContains(root, scope, file) {
+    // The compiled repository policy includes this private-file family. Handle
+    // it only as a denial, never as a wildcard grant or an ignored block.
+    if (scope === '.env.*')
+        return file.startsWith(path.join(root, '.env.'));
+    return contains(scopePath(root, scope), file);
+}
 export class LocalToolPolicy {
     options;
     abort = new AbortController();
@@ -51,7 +58,7 @@ export class LocalToolPolicy {
         if (typeof value !== 'string' || !value || value.includes('\0') || path.isAbsolute(value) || value.split(/[\\/]/).some(p => p === '..' || sensitive(p)))
             throw new Error('DENIED_PATH');
         const root = path.resolve(this.options.worktreeRoot), file = path.resolve(root, value);
-        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => contains(scopePath(root, scope), file)))
+        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => blockedScopeContains(root, scope, file)))
             throw new Error('DENIED_SCOPE');
         if (await realpath(root) !== root)
             throw new Error('DENIED_ROOT');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "private": false,
   "license": "UNLICENSED",
   "bin": {