mtech-ai-local-runner 0.1.25 → 0.1.26

package/README.md

@@ -10,6 +10,15 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.26: compiled private-file denial compatibility
+
+The compiled `.env.*` blocked-path rule now denies that private-file family
+without rejecting unrelated scoped reads. Private files at all depths,
+read-only access and unsupported-pattern rejection remain enforced. Shared
+Claude/Codex policy and actual MCP fake-data regressions use the full compiled
+path combination. Foreground installation does not rerun Codex or update the
+daemon; actual document acceptance still requires a separately approved run.
+
 ## 0.1.25: scoped reads and blocked diagnostics
 
 Codex receives explicit file-scoped ai_local read/search guidance; launch and

package/dist/src/safety/local-tool-policy.js

@@ -15,6 +15,13 @@ function scopePath(root, scope) {
         throw new Error('DENIED_UNSUPPORTED_SCOPE');
     return path.resolve(root, directory);
 }
+function blockedScopeContains(root, scope, file) {
+    // The compiled repository policy includes this private-file family. Handle
+    // it only as a denial, never as a wildcard grant or an ignored block.
+    if (scope === '.env.*')
+        return file.startsWith(path.join(root, '.env.'));
+    return contains(scopePath(root, scope), file);
+}
 export class LocalToolPolicy {
     options;
     abort = new AbortController();
@@ -51,7 +58,7 @@ export class LocalToolPolicy {
         if (typeof value !== 'string' || !value || value.includes('\0') || path.isAbsolute(value) || value.split(/[\\/]/).some(p => p === '..' || sensitive(p)))
             throw new Error('DENIED_PATH');
         const root = path.resolve(this.options.worktreeRoot), file = path.resolve(root, value);
-        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => contains(scopePath(root, scope), file)))
+        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => blockedScopeContains(root, scope, file)))
             throw new Error('DENIED_SCOPE');
         if (await realpath(root) !== root)
             throw new Error('DENIED_ROOT');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "private": false,
   "license": "UNLICENSED",
   "bin": {