mtech-ai-local-runner 0.1.26 → 0.1.28

package/README.md

@@ -10,6 +10,26 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.28: completion receipt wire compatibility
+
+Completion transport separates local timing/process observations from the strict
+official-exec v2/v3 security receipt without changing its authority fields or
+Gateway validation. Other receipt protocols and the original caller result are
+unchanged. The existing 0.1.27 two-document actual acceptance and its same-Job
+completion recovery are recorded separately; installing this patch does not
+rerun Codex, alter personal login/settings or update the daemon.
+
+## 0.1.27: explicit job MCP exposure
+
+The job-local MCP omits deferred and Code Mode surfaces so the inspected ordinary
+MCP path keeps its tools directly available. Server authentication, enabled tools
+and scoped read-only/private-path checks remain unchanged. Exact-binary no-model
+inspection accepted the configuration and registered four synthetic tools;
+the subsequent separately approved actual run read both documents successfully.
+The initial model-request tool list was not captured; observed scoped reads are
+distinct evidence from a complete model-catalog inspection.
+Foreground installation does not run Codex or update the daemon.
+
 ## 0.1.26: compiled private-file denial compatibility
 
 The compiled `.env.*` blocked-path rule now denies that private-file family

package/dist/src/adapters/codex/compatibility.js

@@ -6,6 +6,9 @@
 export const CODEX_ISOLATION_EXEC_FLAGS = Object.freeze([
     "--ignore-user-config", "--ignore-rules", "--ephemeral", "--strict-config", "--json",
 ]);
+// Job MCP tools must be in the initial model catalog, not discoverable only via
+// tool_search or nested Code Mode. This changes exposure, not tool authority.
+export const CODEX_JOB_MCP_OMIT_SURFACES = Object.freeze(['code_mode', 'deferred']);
 export const CODEX_ISOLATION_CONFIG_OVERRIDES = Object.freeze([
     "analytics.enabled=false",
     "project_doc_max_bytes=0",

package/dist/src/adapters/codex/config-builder.js

@@ -1,5 +1,5 @@
 import { isAbsolute } from "node:path";
-import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES } from "./compatibility.js";
+import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES, CODEX_JOB_MCP_OMIT_SURFACES } from "./compatibility.js";
 import { codexControlDenials } from './scratch.js';
 /** Candidate invocation; execution still requires independent compatibility admission. */
 export function buildCodexInvocation(input) {
@@ -22,7 +22,7 @@ export function buildCodexInvocation(input) {
         `permissions.local_job.filesystem={":minimal"="read",${deniedFiles}}`,
         "permissions.local_job.network.enabled=false",
         // Only this job server is preauthorized: every operation is checked by Runner policy.
-        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"]}}`,
+        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"],omit_tools_from=${JSON.stringify(CODEX_JOB_MCP_OMIT_SURFACES)}}}`,
     ];
     const env = { HOME: input.env.HOME, AI_GATEWAY_JOB_MCP_TOKEN: input.endpoint.token };
     for (const key of ["PATH", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "CODEX_HOME"]) {

package/dist/src/adapters/codex/native-policy.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { record } from './stdio-rpc.js';
-import { CODEX_ISOLATION_CONFIG_OVERRIDES } from './compatibility.js';
+import { CODEX_ISOLATION_CONFIG_OVERRIDES, CODEX_JOB_MCP_OMIT_SURFACES } from './compatibility.js';
 import { localToolInventory } from '../../safety/local-tool-server.js';
 import { codexControlDenials } from './scratch.js';
 export const canonical = (value) => JSON.stringify(normalize(value));
@@ -102,10 +102,11 @@ export function validateNativeConfig(value, requirements, pin) {
     const server = record(servers.ai_local);
     if (server.url !== pin.endpoint || server.bearer_token_env_var !== 'AI_GATEWAY_JOB_MCP_TOKEN'
         || server.required !== true || server.enabled !== true || server.default_tools_approval_mode !== 'approve'
+        || canonical(server.omit_tools_from) !== canonical(CODEX_JOB_MCP_OMIT_SURFACES)
         || canonical([...(server.enabled_tools ?? [])].sort()) !== canonical(localToolInventory().map(t => t.name).sort()))
         reject();
     for (const k of Object.keys(server))
-        if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools'].includes(k))
+        if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools', 'omit_tools_from'].includes(k))
             reject();
     return fingerprint({ config: c, requirements: req, ...(pin.accountSources ? { accountSources: pin.accountSources.fingerprint } : {}) });
 }

package/dist/src/gateway-client.js

@@ -481,13 +481,25 @@ export class McpGatewayClient {
         };
     }
     async completeLocalJob(input) {
+        let result = input.result;
+        const receipt = result.security_receipt;
+        if (receipt && !Array.isArray(receipt) && receipt.transport === "official_exec_v1"
+            && ["cli-exec-job-security-receipt-v2", "cli-exec-job-security-receipt-v3"].includes(String(receipt.receipt_version))) {
+            // These local observations are not part of the strict Gateway authority
+            // receipt. Preserve the original locally and every other field unchanged;
+            // unknown authority fields must still reach, and be rejected by, Gateway.
+            const authority = { ...receipt };
+            delete authority.preparation_timing;
+            delete authority.launch_process;
+            result = { ...result, security_receipt: authority };
+        }
         await this.callTool("local_agent_job_complete", {
             job_id: input.jobId,
             generation: input.generation,
             lease_token: input.leaseToken,
             runner_id: this.runnerId,
             status: input.status,
-            result: input.result,
+            result,
         });
     }
     async heartbeatLocalJob(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "private": false,
   "license": "UNLICENSED",
   "bin": {