mtech-ai-local-runner 0.1.27 → 0.1.28

package/README.md

@@ -10,13 +10,24 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.28: completion receipt wire compatibility
+
+Completion transport separates local timing/process observations from the strict
+official-exec v2/v3 security receipt without changing its authority fields or
+Gateway validation. Other receipt protocols and the original caller result are
+unchanged. The existing 0.1.27 two-document actual acceptance and its same-Job
+completion recovery are recorded separately; installing this patch does not
+rerun Codex, alter personal login/settings or update the daemon.
+
 ## 0.1.27: explicit job MCP exposure
 
 The job-local MCP omits deferred and Code Mode surfaces so the inspected ordinary
 MCP path keeps its tools directly available. Server authentication, enabled tools
 and scoped read-only/private-path checks remain unchanged. Exact-binary no-model
 inspection accepted the configuration and registered four synthetic tools;
-actual model selection and document reads still require separate acceptance.
+the subsequent separately approved actual run read both documents successfully.
+The initial model-request tool list was not captured; observed scoped reads are
+distinct evidence from a complete model-catalog inspection.
 Foreground installation does not run Codex or update the daemon.
 
 ## 0.1.26: compiled private-file denial compatibility

package/dist/src/gateway-client.js

@@ -481,13 +481,25 @@ export class McpGatewayClient {
         };
     }
     async completeLocalJob(input) {
+        let result = input.result;
+        const receipt = result.security_receipt;
+        if (receipt && !Array.isArray(receipt) && receipt.transport === "official_exec_v1"
+            && ["cli-exec-job-security-receipt-v2", "cli-exec-job-security-receipt-v3"].includes(String(receipt.receipt_version))) {
+            // These local observations are not part of the strict Gateway authority
+            // receipt. Preserve the original locally and every other field unchanged;
+            // unknown authority fields must still reach, and be rejected by, Gateway.
+            const authority = { ...receipt };
+            delete authority.preparation_timing;
+            delete authority.launch_process;
+            result = { ...result, security_receipt: authority };
+        }
         await this.callTool("local_agent_job_complete", {
             job_id: input.jobId,
             generation: input.generation,
             lease_token: input.leaseToken,
             runner_id: this.runnerId,
             status: input.status,
-            result: input.result,
+            result,
         });
     }
     async heartbeatLocalJob(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "private": false,
   "license": "UNLICENSED",
   "bin": {