mtech-ai-local-runner 0.1.26 → 0.1.27

package/README.md

@@ -10,6 +10,15 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.27: explicit job MCP exposure
+
+The job-local MCP omits deferred and Code Mode surfaces so the inspected ordinary
+MCP path keeps its tools directly available. Server authentication, enabled tools
+and scoped read-only/private-path checks remain unchanged. Exact-binary no-model
+inspection accepted the configuration and registered four synthetic tools;
+actual model selection and document reads still require separate acceptance.
+Foreground installation does not run Codex or update the daemon.
+
 ## 0.1.26: compiled private-file denial compatibility
 
 The compiled `.env.*` blocked-path rule now denies that private-file family

package/dist/src/adapters/codex/compatibility.js

@@ -6,6 +6,9 @@
 export const CODEX_ISOLATION_EXEC_FLAGS = Object.freeze([
     "--ignore-user-config", "--ignore-rules", "--ephemeral", "--strict-config", "--json",
 ]);
+// Job MCP tools must be in the initial model catalog, not discoverable only via
+// tool_search or nested Code Mode. This changes exposure, not tool authority.
+export const CODEX_JOB_MCP_OMIT_SURFACES = Object.freeze(['code_mode', 'deferred']);
 export const CODEX_ISOLATION_CONFIG_OVERRIDES = Object.freeze([
     "analytics.enabled=false",
     "project_doc_max_bytes=0",

package/dist/src/adapters/codex/config-builder.js

@@ -1,5 +1,5 @@
 import { isAbsolute } from "node:path";
-import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES } from "./compatibility.js";
+import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES, CODEX_JOB_MCP_OMIT_SURFACES } from "./compatibility.js";
 import { codexControlDenials } from './scratch.js';
 /** Candidate invocation; execution still requires independent compatibility admission. */
 export function buildCodexInvocation(input) {
@@ -22,7 +22,7 @@ export function buildCodexInvocation(input) {
         `permissions.local_job.filesystem={":minimal"="read",${deniedFiles}}`,
         "permissions.local_job.network.enabled=false",
         // Only this job server is preauthorized: every operation is checked by Runner policy.
-        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"]}}`,
+        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"],omit_tools_from=${JSON.stringify(CODEX_JOB_MCP_OMIT_SURFACES)}}}`,
     ];
     const env = { HOME: input.env.HOME, AI_GATEWAY_JOB_MCP_TOKEN: input.endpoint.token };
     for (const key of ["PATH", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "CODEX_HOME"]) {

package/dist/src/adapters/codex/native-policy.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { record } from './stdio-rpc.js';
-import { CODEX_ISOLATION_CONFIG_OVERRIDES } from './compatibility.js';
+import { CODEX_ISOLATION_CONFIG_OVERRIDES, CODEX_JOB_MCP_OMIT_SURFACES } from './compatibility.js';
 import { localToolInventory } from '../../safety/local-tool-server.js';
 import { codexControlDenials } from './scratch.js';
 export const canonical = (value) => JSON.stringify(normalize(value));
@@ -102,10 +102,11 @@ export function validateNativeConfig(value, requirements, pin) {
     const server = record(servers.ai_local);
     if (server.url !== pin.endpoint || server.bearer_token_env_var !== 'AI_GATEWAY_JOB_MCP_TOKEN'
         || server.required !== true || server.enabled !== true || server.default_tools_approval_mode !== 'approve'
+        || canonical(server.omit_tools_from) !== canonical(CODEX_JOB_MCP_OMIT_SURFACES)
         || canonical([...(server.enabled_tools ?? [])].sort()) !== canonical(localToolInventory().map(t => t.name).sort()))
         reject();
     for (const k of Object.keys(server))
-        if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools'].includes(k))
+        if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools', 'omit_tools_from'].includes(k))
             reject();
     return fingerprint({ config: c, requirements: req, ...(pin.accountSources ? { accountSources: pin.accountSources.fingerprint } : {}) });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "private": false,
   "license": "UNLICENSED",
   "bin": {