mtech-ai-local-runner 0.1.25 → 0.1.27

package/README.md

@@ -10,6 +10,24 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.27: explicit job MCP exposure
+
+The job-local MCP omits deferred and Code Mode surfaces so the inspected ordinary
+MCP path keeps its tools directly available. Server authentication, enabled tools
+and scoped read-only/private-path checks remain unchanged. Exact-binary no-model
+inspection accepted the configuration and registered four synthetic tools;
+actual model selection and document reads still require separate acceptance.
+Foreground installation does not run Codex or update the daemon.
+
+## 0.1.26: compiled private-file denial compatibility
+
+The compiled `.env.*` blocked-path rule now denies that private-file family
+without rejecting unrelated scoped reads. Private files at all depths,
+read-only access and unsupported-pattern rejection remain enforced. Shared
+Claude/Codex policy and actual MCP fake-data regressions use the full compiled
+path combination. Foreground installation does not rerun Codex or update the
+daemon; actual document acceptance still requires a separately approved run.
+
 ## 0.1.25: scoped reads and blocked diagnostics
 
 Codex receives explicit file-scoped ai_local read/search guidance; launch and

package/dist/src/adapters/codex/compatibility.js

@@ -6,6 +6,9 @@
 export const CODEX_ISOLATION_EXEC_FLAGS = Object.freeze([
     "--ignore-user-config", "--ignore-rules", "--ephemeral", "--strict-config", "--json",
 ]);
+// Job MCP tools must be in the initial model catalog, not discoverable only via
+// tool_search or nested Code Mode. This changes exposure, not tool authority.
+export const CODEX_JOB_MCP_OMIT_SURFACES = Object.freeze(['code_mode', 'deferred']);
 export const CODEX_ISOLATION_CONFIG_OVERRIDES = Object.freeze([
     "analytics.enabled=false",
     "project_doc_max_bytes=0",

package/dist/src/adapters/codex/config-builder.js

@@ -1,5 +1,5 @@
 import { isAbsolute } from "node:path";
-import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES } from "./compatibility.js";
+import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES, CODEX_JOB_MCP_OMIT_SURFACES } from "./compatibility.js";
 import { codexControlDenials } from './scratch.js';
 /** Candidate invocation; execution still requires independent compatibility admission. */
 export function buildCodexInvocation(input) {
@@ -22,7 +22,7 @@ export function buildCodexInvocation(input) {
         `permissions.local_job.filesystem={":minimal"="read",${deniedFiles}}`,
         "permissions.local_job.network.enabled=false",
         // Only this job server is preauthorized: every operation is checked by Runner policy.
-        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"]}}`,
+        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"],omit_tools_from=${JSON.stringify(CODEX_JOB_MCP_OMIT_SURFACES)}}}`,
     ];
     const env = { HOME: input.env.HOME, AI_GATEWAY_JOB_MCP_TOKEN: input.endpoint.token };
     for (const key of ["PATH", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "CODEX_HOME"]) {

package/dist/src/adapters/codex/native-policy.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { record } from './stdio-rpc.js';
-import { CODEX_ISOLATION_CONFIG_OVERRIDES } from './compatibility.js';
+import { CODEX_ISOLATION_CONFIG_OVERRIDES, CODEX_JOB_MCP_OMIT_SURFACES } from './compatibility.js';
 import { localToolInventory } from '../../safety/local-tool-server.js';
 import { codexControlDenials } from './scratch.js';
 export const canonical = (value) => JSON.stringify(normalize(value));
@@ -102,10 +102,11 @@ export function validateNativeConfig(value, requirements, pin) {
     const server = record(servers.ai_local);
     if (server.url !== pin.endpoint || server.bearer_token_env_var !== 'AI_GATEWAY_JOB_MCP_TOKEN'
         || server.required !== true || server.enabled !== true || server.default_tools_approval_mode !== 'approve'
+        || canonical(server.omit_tools_from) !== canonical(CODEX_JOB_MCP_OMIT_SURFACES)
         || canonical([...(server.enabled_tools ?? [])].sort()) !== canonical(localToolInventory().map(t => t.name).sort()))
         reject();
     for (const k of Object.keys(server))
-        if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools'].includes(k))
+        if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools', 'omit_tools_from'].includes(k))
             reject();
     return fingerprint({ config: c, requirements: req, ...(pin.accountSources ? { accountSources: pin.accountSources.fingerprint } : {}) });
 }

package/dist/src/safety/local-tool-policy.js

@@ -15,6 +15,13 @@ function scopePath(root, scope) {
         throw new Error('DENIED_UNSUPPORTED_SCOPE');
     return path.resolve(root, directory);
 }
+function blockedScopeContains(root, scope, file) {
+    // The compiled repository policy includes this private-file family. Handle
+    // it only as a denial, never as a wildcard grant or an ignored block.
+    if (scope === '.env.*')
+        return file.startsWith(path.join(root, '.env.'));
+    return contains(scopePath(root, scope), file);
+}
 export class LocalToolPolicy {
     options;
     abort = new AbortController();
@@ -51,7 +58,7 @@ export class LocalToolPolicy {
         if (typeof value !== 'string' || !value || value.includes('\0') || path.isAbsolute(value) || value.split(/[\\/]/).some(p => p === '..' || sensitive(p)))
             throw new Error('DENIED_PATH');
         const root = path.resolve(this.options.worktreeRoot), file = path.resolve(root, value);
-        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => contains(scopePath(root, scope), file)))
+        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => blockedScopeContains(root, scope, file)))
             throw new Error('DENIED_SCOPE');
         if (await realpath(root) !== root)
             throw new Error('DENIED_ROOT');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "private": false,
   "license": "UNLICENSED",
   "bin": {